Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains

Apple iOS (Safari/WebKit) and Chrome for Android

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome.

Why this severity: State-actor zero-click exploitation of unpatched phones; all bugs already fixed by Apple and Google

Started
Aug 27, 2026
CVEs
CVE-2025-43529CVE-2024-27834CVE-2026-20700CVE-2025-14174CVE-2025-43510CVE-2025-43520CVE-2026-3910CVE-2025-27038

Follow this incident

Discuss on X ↗

Affected

  • iOS 16.7 (cookie-theft chain)
  • iOS 18.5 (DarkSword chain)
  • Chrome for Android 139 to 145, except 143

Fixed in

  • Latest iOS release for your device (Apple shipped fixes to older iOS lines too)
  • Latest Chrome for Android

Timeline2

  1. Sekoia publishes the campaign, attributing it to APT29 with moderate to high confidence; it is working with national CERTs on victim identification and takedown.

  2. Attackers inject a fingerprinting script into Plerdy's tracker (a.plerdy.com), loaded by thousands of mostly Ukrainian websites, until Sep 3.

News & write-ups3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo