Russian Hackers Deploy N-Day Exploits in Zero-Click Attacks on iOS, Android

CVE-2025-43529 is linked to the “DarkSword” exploit kit, first documented in March and used in attacks since at least November 2025, according to researchers who traced a broad watering-hole campaign that delivered zero-click n-day exploit chains to iOS and Android visitors.

How the campaign worked, according to Sekoia

Researchers at cybersecurity company Sekoia describe a multi-site watering-hole operation that delivered a small JavaScript profiling payload to visitors of compromised and lookalike websites. The script fingerprinted devices and browser versions; a command-and-control server then pushed platform-specific n-day exploit chains “without user interaction,” enabling zero-click compromises when a matched exploit was available.

Sekoia attributes the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), citing similarities to previous watering-hole activity, infrastructure overlaps, and a partner-linked compromise associated with a 2025 APT29 campaign.

Compromised sites and impersonations

The researchers found multiple high-profile legitimate sites across the U.S., Ukraine, the Czech Republic, and Bulgaria that served the same malicious payload. Compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. In addition, lookalike domains impersonated the official America250 site and Raffles London at The OWO hotel, relaying real site content in an adversary-in-the-middle model.

Sekoia also discovered the threat actor had compromised Ukrainian web analytics service Plerdy and modified its SEO tracker; that modified tracker was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3, the researchers say.

Exploits, platforms, and data targeted

Sekoia enumerated the specific vulnerabilities and the data the exploit payloads sought to extract:

• iOS 16.7: CVE-2025-43529 and CVE-2024-27834 — payload targets cookies stored in Safari.
• iOS 18.5: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 — payload harvests WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
• Chrome for Android (versions 139 to 145, excluding 143): CVE-2026-3910 and CVE-2025-27038 — a tool described as AndroSnitch collects Chrome cookies, login data, browsing history, and saved WiFi credentials.

Sekoia also identified four additional vulnerabilities present in unreachable code or alternative exploit paths; those were not used in the analyzed chains.

Operational characteristics and limits of the payloads

Notably, Sekoia reports that none of the payloads observed in these attacks established persistence on infected devices. A device reboot stopped the malicious activity until the user revisited a compromised or impersonating site. The researchers describe CVE-2025-43529’s association with the DarkSword kit and say DarkSword has been leveraged by multiple threat groups since at least November 2025.

What this means for technologists, enterprises, and end users

• Technologists and security teams: monitor and audit third-party web resources and analytics providers for unauthorized modifications — Sekoia’s finding that Plerdy’s SEO tracker was altered and loaded by thousands of sites underscores the risk from supply-chain-style compromises.
• Affected enterprises and procurement leaders: review externally hosted content and lookalike-domain risks for public-facing portals and partner pages, given the campaign’s use of impersonating domains and relayed content in an adversary-in-the-middle model.
• End users and general public: apply the latest security updates for Apple and Google devices immediately — Sekoia reports Apple and Google have patched all flaws targeted in this campaign, with fixes available even for older iOS releases — and bear in mind that a reboot will halt observed payload activity until a return visit to a compromised site.

The operation Sekoia uncovered stitches together several persistent themes: the reuse of a known exploit kit (DarkSword), watering-hole compromises of high-profile sites, compromises of third-party analytics code, and automated, profile-driven delivery of n-day chains that require no interaction. The practical mitigation steps are clear in the researchers’ findings: apply vendor patches, reduce exposure to third-party web components, and treat lookalike domains and relayed content as active threats. Sekoia’s attribution to APT29 ties this activity to a pattern of watering-hole operations and infrastructure reuse, but the immediate technical takeaway for defenders is operational — patch, audit, and avoid reopened visits to compromised pages until supply-chain integrity is confirmed.

Original reporting: https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/