Russian hackers target iOS and Android users with n-day exploits

Sekoia researchers report that Russia's APT29 (also known as Midnight Blizzard or Cozy Bear) ran a mobile-focused watering-hole operation discovered in mid-October 2026, combining injected JavaScript on legitimate sites, lookalike domains, and a compromised Ukrainian analytics service called Plerdy to profile visitors and push device-specific exploit chains without any user interaction. Targets included a Ukrainian gas company, a US chemical trade group, military-linked organizations in Ukraine and Bulgaria, and spoofed pages mimicking America250 and the Raffles London hotel near UK government buildings, suggesting interest in high-profile and diplomatic visitors amid the Russia-Ukraine war. On iOS 16.7 the attackers chained CVE-2025-43529 and CVE-2024-27834 to steal session cookies, while iOS 18.5 devices faced the DarkSword kit using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to harvest messages, Keychain data, location and photos; Android users on Chrome 139-145 were hit via CVE-2026-3910 and CVE-2025-27038 to grab cookies, saved logins and Wi-Fi passwords. Sekoia notes every exploited flaw was already patched, so fully updated devices remain safe, and it is coordinating with national CERTs, including CERT-UA, to track victims and disrupt the infrastructure.