Hackers use n-day exploits in zero-click attacks on iOS, Android devices

Sekoia researchers have uncovered a large watering-hole campaign, attributed with moderate-to-high confidence to the Russian group APT29 (Midnight Blizzard), that silently compromised iOS and Android devices visiting booby-trapped legitimate sites and lookalike domains in the US, Ukraine, Czechia and Bulgaria. Victims included a Ukrainian gas company, a US chemical trade group, a Bulgarian military-linked site, and fake clones of America250 and Raffles London's OWO hotel, plus a hijacked Ukrainian analytics tool called Plerdy used by thousands of sites. Injected JavaScript fingerprinted each visitor's device and browser before a command-and-control server pushed a matching zero-click exploit chain abusing flaws such as CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038 across iOS 16.7, iOS 18.5 and Chrome for Android (versions 139-145, except 143), stealing Safari cookies, WhatsApp/Telegram data, Keychain credentials, location history and Chrome-stored logins. Since none of the payloads achieved persistence, a simple device restart interrupts the attack, but Apple and Google have already shipped patches, including backports to older iOS builds, so users should update immediately.