Researchers Detail APT29-Linked Zero-Click Attacks Against iOS and Android Devices

Trusted websites become an entry point

Cybersecurity company Sekoia published a new investigation on November 4 describing a campaign that targeted iPhone and Android users through compromised websites, lookalike domains and a third-party web analytics service. Sekoia attributed the operation to the Russian-linked threat group APT29 with moderate-to-high confidence. The attackers inserted JavaScript into web pages to identify visitors’ operating systems and browser versions, then delivered exploit chains tailored to devices that met their criteria. The activity has been described as zero-click because victims did not need to click a second link or download a file after the malicious page loaded. However, the attack still required a person to visit a compromised or impersonating website. It should not be interpreted as an attack that could compromise any phone remotely without the user visiting an affected page.

Three routes delivered the malicious code

Sekoia identified three infection methods. The first involved direct compromise of legitimate websites, including sites belonging to a Ukrainian gas producer, a U.S. chemical-industry trade association and a Bulgarian military-related organization. The second used lookalike websites that acted as reverse proxies: they displayed content from legitimate sites while secretly modifying the page to inject malicious JavaScript. Sekoia identified impersonation sites targeting America250, the U.S. initiative marking the country’s 250th anniversary, and Raffles London at The OWO hotel. The third route involved a supply-chain compromise of the Ukrainian analytics service Plerdy. Between August 27 and September 3, 2026, attackers modified its SEO Tracker script. Websites that loaded the tracker could then expose visitors to the malicious code. Sekoia said the tracker was used by thousands of websites, most of them in Ukraine. That figure describes websites loading the component, not a confirmed number of infected phones or victims.

Separate exploit chains targeted iPhones and Android

Sekoia recovered three complete exploit chains. The first targeted iOS 16.7 and used CVE-2025-43529 and CVE-2024-27834 to steal browser cookies. A second chain targeted iOS 18.5 and used five vulnerabilities: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Sekoia said this chain could collect a much broader range of information, including messages, messaging-app databases, credentials stored in the Keychain, location data, photos and other device information. The Android chain targeted Chrome versions 139 through 145, excluding version 143. It used CVE-2026-3910 and CVE-2025-27038 to collect Chrome cookies, saved login information, browsing history and stored Wi-Fi credentials. The researchers also noted that the delivery infrastructure selected the exploit chain according to the visitor’s operating system and browser version.

APT29 attribution remains an assessment

Sekoia linked the campaign to APT29 based on infrastructure overlaps, technical similarities with previous operations, operational patterns and the types of websites affected. The group is also known as Midnight Blizzard, Cozy Bear and The Dukes, and is widely attributed to Russia’s Foreign Intelligence Service. Sekoia assigned the attribution moderate-to-high confidence. That assessment should not be mistaken for a public government confirmation. Sekoia said part of its reasoning relied on a private report supplied by a partner, which outside researchers cannot independently examine. The firm also described some elements of its attribution as less certain. The available evidence therefore supports reporting that Sekoia assesses the campaign as APT29-linked, not stating that the Russian government has been conclusively identified as the operator.

The vulnerabilities were already patched

The campaign did not rely on newly discovered zero-day vulnerabilities. Sekoia said all three exploit chains used known vulnerabilities for which vendors had already released fixes. Such flaws are often called n-day vulnerabilities: the weaknesses are publicly known and patches exist, but devices that have not installed those updates may remain exposed. Google Threat Intelligence Group and Lookout previously documented the DarkSword iOS exploit chain and described the vulnerabilities used in related attacks. Apple subsequently issued fixes across multiple software releases. Google also released a Chrome security update addressing CVE-2026-3910. Users should install the latest security updates available for their phones and browsers, while organizations should review third-party website scripts, analytics services and external JavaScript dependencies. The incident demonstrates how a compromised component on an otherwise legitimate website can become a delivery channel for attacks against visitors.