A large-scale watering hole attack has been targeting iOS and Android users, according to multiple sources. The campaign is attributed to APT29, also known as Midnight Blizzard, with moderate-to-high confidence.
The attackers have compromised legitimate websites, including those of a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site. Additionally, lookalike domains were created to impersonate the official America250 site and Raffles London at The OWO hotel.
APT29 also compromised a Ukrainian web analytics service, Plerdy, which distributed their malicious code across thousands of websites. The initial payload involved JavaScript that profiled visitors to determine their devices and browser versions.
The attackers exploited multiple vulnerabilities to extract cookies, messaging app databases, and credentials. Specific vulnerabilities in iOS 16.7 and iOS 18.5, as well as in Chrome for Android versions 139 to 145 (excluding 143), were targeted.
None of the payloads established persistence, meaning that a device reboot stops the malicious activity until the user revisits a compromised site. Apple and Google have patched all the flaws targeted in this campaign.
The campaign began in mid-October 2026, and exploitation of the vulnerabilities has been reported.