APT29 Watering Hole Attack Targets Unpatched iPhones and Android

Russia-linked hacking group APT29 used poisoned websites to attack unpatched iPhones and Android phones, security firm Sekoia said on November 4. Simply opening one of the infected or fake sites was enough for the attackers to try to steal browser cookies, Wi-Fi passwords and, on some iPhones, nearly all of the data on the device.

This kind of attack is called a watering hole: instead of targeting a victim directly, hackers infect websites their targets are likely to visit. Sekoia found the campaign, which it calls Poisoned Source, in mid-October and says with "moderate to high confidence" that it was run by APT29, the group also known as Cozy Bear and Midnight Blizzard, which is widely tied to Russia's Foreign Intelligence Service (SVR), according to its report.

How Did the APT29 Attack Reach Phones?

The attackers used three routes. First, they injected malicious JavaScript into real websites. Second, they built lookalike sites that act as a middleman, or reverse proxy, in front of the real ones. One of them, america250[.]holiday, copied America250.org, the official site for the 250th anniversary of US independence. Third, they hacked Plerdy, a Ukrainian web analytics service, so every site using its tracker served the attack code between August 27 and September 3, 2026, according to a summary of Sekoia's findings.

In every case, the code first checked which phone and browser the visitor had. It then served a matching exploit chain, a series of linked bugs that break through a device's defenses. No tap or download was needed.

Which iPhone and Android Versions Were Targeted?

Sekoia recovered three chains. One targeted iOS 16.7 to steal cookies. A second, built on the DarkSword exploit kit, targeted iOS 18.5 and could copy messages, email databases, WhatsApp and Telegram data, iCloud Keychain, photos and more. The third went after Chrome versions 139 to 145 on Android, skipping version 143, to grab Chrome data and Wi-Fi passwords. None of the payloads stayed on the phone after a restart.

Notably, DarkSword has a commercial past. Google researchers previously linked it to customers of PARS Defense, a surveillance vendor in Turkey, and at least two other groups, Ars Technica reports. That mirrors other cases of mercenary spyware aimed at iPhones.

Are You at Risk?

All the flaws used are n-day bugs, meaning they were already known and patched. As a result, phones running current software are protected. The real danger is for people who delay updates. Therefore, install the latest iOS release, such as the recent iOS 27.2 security update, and keep Chrome and Android up to date.

The case also echoes a wider trend. AI tools are now finding bugs at scale, as with OpenAI's 948 Linux kernel exploits, which makes the gap between a patch and an attack even more important.

Our Take

This campaign did not need any zero-day bugs. Instead, it relied on the simple fact that many people never update their phones. A spy agency with this much reach could have burned rare, expensive exploits. However, it did not have to. That is the strongest argument yet for turning on automatic updates today.