# APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains · pwn.watch > Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome. Page: https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy · generated 2026-11-04T12:48:50.450Z ## Status - Severity: high · status: live · patch: patched - Product: Apple iOS (Safari/WebKit) and Chrome for Android - Started: 2026-08-27 - CVEs: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038 - Affected: iOS 16.7 (cookie-theft chain); iOS 18.5 (DarkSword chain); Chrome for Android 139 to 145, except 143 - Fixed in: Latest iOS release for your device (Apple shipped fixes to older iOS lines too); Latest Chrome for Android ## Follow this incident - RSS (one item per update): https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/feed.xml - JSON Feed: https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy.json - This file: https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy/llms.txt ## Updates (newest first) - 2026-11-04: Sekoia publishes the campaign, attributing it to APT29 with moderate to high confidence; it is working with national CERTs on victim identification and takedown. (https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) - 2026-08-27: Attackers inject a fingerprinting script into Plerdy's tracker (a.plerdy.com), loaded by thousands of mostly Ukrainian websites, until Sep 3. (https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) ## Fix brief # Security brief: APT29 watering holes hit outdated iPhones and Android Chrome with zero-click n-day exploit chains Source: https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy · status: live · severity: high · updated Nov 4, 2026, 10:12 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Sekoia reported a large watering-hole campaign it attributes with moderate to high confidence to Russia's APT29. Hacked legitimate sites in the US, Ukraine, Czech Republic and Bulgaria, lookalike domains proxying real sites (America250, Raffles London at The OWO) and a compromised Plerdy analytics tracker (loaded by thousands of mostly Ukrainian sites, Aug 27 to Sep 3 2026) fingerprinted mobile visitors and served exploit chains with no user interaction. iOS 16.7 got a Safari cookie-stealing chain, iOS 18.5 got the DarkSword kit (WhatsApp and Telegram databases, Keychain, location, photos), and Chrome for Android 139 to 145 got AndroSnitch (cookies, saved logins, history, Wi-Fi passwords). Every bug used is already patched and nothing persists after a reboot, so update iOS and Chrome. Severity detail: State-actor zero-click exploitation of unpatched phones; all bugs already fixed by Apple and Google - Product: Apple iOS (Safari/WebKit) and Chrome for Android - CVE / advisory ids: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038 ## Affected versions - iOS 16.7 (cookie-theft chain) - iOS 18.5 (DarkSword chain) - Chrome for Android 139 to 145, except 143 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Latest iOS release for your device (Apple shipped fixes to older iOS lines too) - Latest Chrome for Android After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Update iPhones (Settings > General > Software Update) and Chrome for Android (Play Store). A reboot ends any active payload since none persist; rotate sessions for webmail and other browser logins on devices that were outdated. Sites that embedded Plerdy between Aug 27 and Sep 3 2026 should review the tracker include. ## Latest updates - Nov 4, 2026: Sekoia publishes the campaign, attributing it to APT29 with moderate to high confidence; it is working with national CERTs on victim identification and takedown. - Aug 27, 2026: Attackers inject a fingerprinting script into Plerdy's tracker (a.plerdy.com), loaded by thousands of mostly Ukrainian websites, until Sep 3. ## Write-ups & news - [Poisoned Source: APT29 watering holes target mobile devices with n-day exploits](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) - [Hackers use n-day exploits in zero-click attacks on iOS, Android devices](https://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/) - [Russian Intel Hackers Troll Mobile Devices for Login Cookies](https://www.govinfosecurity.com/russian-intel-hackers-troll-mobile-devices-for-login-cookies-a-33287) --- Machine-readable: https://pwn.watch/i/apt29-watering-hole-ios-android-n-day-exploits-plerdy.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.