Russian hackers target iOS and Android users with n-day exploits
Android is now the target of an action by law enforcement.
APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia) The company’s Threat Detection & Research (TDR) team spotted the operation in mid-October 2026.
Over the summer, Microsoft reported that the group had spent months hijacking hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware.
Every flaw in the three chains had been fixed before the campaign began, and Sekoia stressed that “a user running an up-to-date operating system is safe from these attacks.” The company said it is working with the CERTs of the affected countries, CERT-UA among them, to identify victims and look for ways to disrupt the watering hole infrastructure.
The attribution to APT29 rests on traces of a 2025 APT29 watering hole operation found on one of the compromised sites, similarities with a 2024 APT29 campaign against Mongolian government websites that Google’s Threat Analysis Group confirmed , and a victim list centered on Ukraine.
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals.
This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction." Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks .
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Sekoia said the compromise, which ran from August 27 to September 3, exposed hundreds of them and their visitors to the exploit kit.
The delivery host then uses the mobile and browser version to serve platform-specific n-day exploit chains without user interaction.” The investigation started with a malicious script on the website of a Ukrainian gas production company.
The researchers identified four other vulnerabilities in unreachable code or alternate exploit paths, but they were not used in the analyzed chains.
What happened
APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia) The company’s Threat Detection & Research (TDR) team spotted the operation in mid-October 2026.
Over the summer, Microsoft reported that the group had spent months hijacking hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware.
What changed
Every flaw in the three chains had been fixed before the campaign began, and Sekoia stressed that “a user running an up-to-date operating system is safe from these attacks.” The company said it is working with the CERTs of the affected countries, CERT-UA among them, to identify victims and look for ways to disrupt the watering hole infrastructure.
The attribution to APT29 rests on traces of a 2025 APT29 watering hole operation found on one of the compromised sites, similarities with a 2024 APT29 campaign against Mongolian government websites that Google’s Threat Analysis Group confirmed , and a victim list centered on Ukraine.
Who is affected
A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals.
This initial stage allows the attacker to determine the browser version to deploy "platform-specific n-day exploit chains without user interaction." Researchers at cybersecurity company Sekoia attribute the operation with moderate-to-high confidence to APT29 (aka Midnight Blizzard), a Russian threat group that was recently linked to hotel WiFi attacks .
Why it matters
Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Sekoia said the compromise, which ran from August 27 to September 3, exposed hundreds of them and their visitors to the exploit kit.
Technical details
The delivery host then uses the mobile and browser version to serve platform-specific n-day exploit chains without user interaction.” The investigation started with a malicious script on the website of a Ukrainian gas production company.
The researchers identified four other vulnerabilities in unreachable code or alternate exploit paths, but they were not used in the analyzed chains.
The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation.
Response
Apple and Google have patched all flaws targeted in this campaign, with fixes even reaching older iOS releases , so users are recommended to apply the latest available security updates for their devices.
The chains used n-day flaws, meaning vulnerabilities already disclosed and patched: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038.
Attribution
Help Net Security: APT29 watering holes target mobile devices with n-day exploits (Source: Sekoia) The company’s Threat Detection & Research (TDR) team spotted the operation in mid-October 2026.
Infosecurity Magazine: It assessed with moderate to high confidence that the group behind it is APT29, also tracked as Midnight Blizzard and Cozy Bear, or at least one of its subgroups.
BleepingComputer: A large-scale watering hole attack associated with Russian hackers has been targeting iOS and Android users visiting compromised sites or fake ones impersonating legitimate portals.
What to watch next
Watch for updated vendor guidance and fixed-version details.