{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains · updates",
  "home_page_url": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy",
  "feed_url": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/feed.json",
  "description": "Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome.",
  "language": "en",
  "_pwn": {
    "slug": "apt29-watering-hole-ios-android-n-day-exploits-plerdy",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/feed.xml",
    "llms": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/llms.txt",
    "json": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy#2026-11-04-4633c621",
      "url": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy#2026-11-04-4633c621",
      "title": "APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains: Sekoia publishes the campaign, attributing it to APT29 with moderate to high confidence; it is working with national CERTs on victim identification and takedown.",
      "content_text": "APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains: Sekoia publishes the campaign, attributing it to APT29 with moderate to high confidence; it is working with national CERTs on victim identification and takedown.\n\nSource: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy#2026-08-27-24b2b9f3",
      "url": "https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy#2026-08-27-24b2b9f3",
      "title": "APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains: Attackers inject a fingerprinting script into Plerdy's tracker (a.plerdy.com), loaded by thousands of mostly Ukrainian websites, until Sep 3.",
      "content_text": "APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains: Attackers inject a fingerprinting script into Plerdy's tracker (a.plerdy.com), loaded by thousands of mostly Ukrainian websites, until Sep 3.\n\nSource: https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
      "date_published": "2026-08-27T00:00:00.000Z",
      "external_url": "https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits",
      "tags": [
        "high"
      ]
    }
  ]
}