{"id":3916,"date":"2026-11-04T06:49:36","date_gmt":"2026-11-04T14:49:36","guid":{"rendered":"https:\/\/cyber.mag212.com\/apt29-watering-hole-outdated-iphone-android-exploits\/"},"modified":"2026-11-04T06:49:36","modified_gmt":"2026-11-04T14:49:36","slug":"apt29-watering-hole-outdated-iphone-android-exploits","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/apt29-watering-hole-outdated-iphone-android-exploits\/","title":{"rendered":"APT29 Watering Holes exploite des failles de s\u00e9curit\u00e9 sur les iPhones et t\u00e9l\u00e9phones Android obsol\u00e8tes\u00a0: comment v\u00e9rifier votre flotte"},"content":{"rendered":"

Sekoia has published research on a large watering-hole campaign that profiled the phones of people visiting compromised and lookalike websites. It then served exploit chains that work only on outdated iPhones and Android phones running old Chrome<\/strong>. The payloads stole browser cookies, saved logins, messaging databases and Wi-Fi passwords. Sekoia attributes the campaign to APT29<\/strong> (also tracked as Midnight Blizzard and Cozy Bear) with moderate-to-high confidence.<\/p>\n\n

Every vulnerability involved was already patched. Devices running a current OS and browser are not affected. The risk sits in the phones your organization assumes are up to date but are not.<\/p>\n\n

Key facts<\/h2>\n\n
Item<\/th>Detail<\/th><\/tr><\/thead>
Researcher<\/td>Sekoia TDR, published November 4, 2026 (campaign detected mid-October)<\/td><\/tr>
Attribution<\/td>APT29, moderate-to-high confidence (Sekoia assessment)<\/td><\/tr>
Targets<\/td>iOS 16.x, iOS 18.5, and Chrome for Android 139\u2013145 (not 143)<\/td><\/tr>
Delivery<\/td>Compromised legitimate sites, lookalike domains, and a compromised analytics tracker<\/td><\/tr>
Persistence<\/td>None observed: a reboot ends it, a revisit re-infects<\/td><\/tr>
Fix<\/td>Already available: update iOS and Chrome or Android System WebView<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

How visitors were reached<\/h2>\n\n

Sekoia found injected JavaScript on the real websites of organizations including a Ukrainian gas producer, a US chemical-industry trade association, a Bulgarian military-related site and several political sites. Lookalike domains relayed genuine content from an America250 portal and a London hotel, in an adversary-in-the-middle style. A third route ran through Plerdy, a Ukrainian web-analytics service whose SEO tracker was compromised between August 27 and September 3, 2026, and loaded by thousands of mostly Ukrainian sites.<\/p>\n\n

\"Diagram
Delivery chain as reported by Sekoia. MAG212 CYBER original diagram.<\/figcaption><\/figure>\n\n

How the exploit chains work<\/h2>\n\n

A fingerprinting script collects 394 data points from 61 collectors and sends them to the attackers’ server. The server-side gate mostly rejects devices that do not look like phones, such as an odd screen size or no touch points. It then returns a matching exploit chain:<\/p>\n\n

Chain<\/th>Target<\/th>CVEs (all patched)<\/th>Data taken<\/th><\/tr><\/thead>
A<\/td>iOS 16.7 (works on 16.0\u201317.4)<\/td>CVE-2025-43529, CVE-2024-27834<\/td>Safari cookies<\/td><\/tr>
B<\/td>iOS 18.5 (“DarkSword” kit)<\/td>CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520<\/td>Messaging databases, Keychain data, location, photos<\/td><\/tr>
C<\/td>Chrome for Android 139\u2013145, not 143 (“AndroSnitch”)<\/td>CVE-2026-3910, CVE-2025-27038<\/td>Chrome cookies, saved logins, history, Wi-Fi configuration<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

All three chains send data to one exfiltration endpoint. None of the payloads established persistence, so rebooting ends the session, though it does not undo data already taken.<\/p>\n\n

Why cookie theft matters to the business<\/h2>\n\n

A stolen session cookie can let an attacker into webmail or a SaaS app without<\/em> a password or MFA prompt, until that session is revoked. Resetting the password alone may not end it. For anyone whose phone could have been exposed, revoke sessions first, then rotate credentials.<\/p>\n\n

How to check your fleet<\/h2>\n\n