Sekoia Links Watering-Hole Attacks on Unpatched iPhones and Android Phones to APT29

Sekoia's Threat Detection & Research team said it found the campaign, which it calls Poisoned Source, in mid-October, after spotting malicious JavaScript on the website of a Ukrainian gas production company. It attributes the activity with moderate to high confidence to APT29, the group also tracked as Midnight Blizzard and Cozy Bear, which it links to Russia's Foreign Intelligence Service, the SVR. The firm said the operation may be the work of a subgroup.

Victims did not have to do anything. Once a vulnerable phone loaded an infected page, the attack ran without a click or a download. Every flaw exploited had already been patched by Apple and Google, so the exposure falls on people and organisations whose phones run old software. Sekoia also said the campaign reused an exploit kit it suspects was built by a commercial surveillance vendor, and it expects state-backed groups to reuse such tools more often.

The Three Routes to Victims

Sekoia identified three ways the code reached phones. In the first, the attackers injected script directly into legitimate websites, including a Bulgarian military-related site. In the second, they set up lookalike domains that passed the real site's pages through to visitors and added malicious script on the way. One copied america250.org, the official site of the US 250th anniversary initiative. Another copied the site of Raffles London at The OWO, a hotel near UK government buildings. The third was a supply-chain compromise of Plerdy, a Ukrainian SEO and analytics service, whose tracking file was altered between August 27 and September 3. Sekoia said this route reached the most sites.

Other compromised sites included a US chemical industry trade association, a far-right European political party, a Czech far-right movement and an Australian medical clinic. The sites that loaded Plerdy included Ukrainian army, special forces and military equipment pages.

What the Exploits Took

A fingerprinting script collected 394 fields of device and browser data. The attackers' server used only a few of them, such as screen size and the number of touch points, to decide whether to send an exploit. Sekoia described three exploit chains. One targeted iOS 16.7 and stole browser cookies, which can keep users logged in to websites. A second, against iOS 18.5, reimplemented an exploit kit known as DarkSword and collected text messages and iMessages, WhatsApp and Telegram databases, Keychain items, location data, Health data, photos and iCloud Drive files. The third targeted Chrome versions 139 to 145 on Android, except 143, and used a library Sekoia named AndroSnitch to take cookies, saved logins, browsing history and Wi-Fi passwords.

The malware did not install itself permanently, so restarting a phone ends the activity, though visiting an infected site again could re-expose an unpatched device. The researchers did not establish how many phones were compromised. "A user running an up-to-date operating system is safe from these attacks," Sekoia wrote.

Sekoia said it worked with national computer emergency response teams, including Ukraine's CERT-UA. Their findings showed traces of a separate APT29 watering-hole campaign in 2025. The firm is coordinating with those CERTs on identifying victims and on options to disrupt the attackers' infrastructure. It said it will share its indicators of compromise with national CERTs and law enforcement on request.