Zero-Click Attacks Exploit N-Day Vulnerabilities in iOS and Android Devices

Hackers deploy zero-click attacks leveraging n-day exploits to compromise iOS and Android devices through targeted watering-hole campaigns.

Attack Overview

A large-scale operation linked to Russian threat actors has been exploiting compromised websites and fake domains to deliver malicious payloads that profile user devices and extract sensitive data without user interaction. The campaign targeted high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria, with attackers using platform-specific exploit chains based on browser versions detected during initial reconnaissance.

Targeted Websites and Domains

The compromised sites included a Ukrainian gas company portal, a U.S. chemical industry trade association, and a Bulgarian military-related website. Attackers also created lookalike domains mimicking the America250 official site and Raffles London at The OWO hotel, employing an adversary-in-the-middle technique to relay content from legitimate sources.

Exploit Chains and Vulnerabilities

The campaign exploited a Ukrainian web analytics service called Plerdy, modifying its SEO tracker to inject malicious code. This compromised tracker was embedded on thousands of websites, primarily in Ukraine, between August 27 and September 3. The initial stage involved JavaScript-based device profiling to identify browser versions, which then triggered delivery of tailored exploit kits from a command-and-control server.

iOS Exploits

Exploits targeting iOS devices included CVE-2025-43529 and CVE-2024-27834 (affecting iOS 16.7), which extracted Safari cookies. For iOS 18.5, attackers used CVE-2025-43520, CVE-2025-14174, CVE-2025-43510, CVE-2026-20700, and CVE-2025-43529 to access Telegram databases, Keychain credentials, location data, and photos.

Android Exploits

On Android, the campaign exploited CVE-2026-3910 and CVE-2025-27038 (affecting Chrome versions 139 to 145, excluding 143) to deploy AndroSnitch, which harvested Chrome cookies, login details, browsing history, and WiFi credentials.

Response and Mitigation

Researchers identified additional vulnerabilities in unused code paths but confirmed they were not utilized in the active exploit chains. CVE-2025-43529, tied to the DarkSword exploit kit, has been used in attacks since November 2025 by multiple threat groups. Sekoia noted that APT29’s payloads did not establish persistence, meaning device reboots temporarily halted malicious activity until users revisited compromised sites.

Sekoia noted that APT29’s payloads did not establish persistence, meaning device reboots temporarily halted malicious activity until users revisited compromised sites.

Conclusion

The report highlights infrastructure overlaps and similarities to past APT29 watering-hole operations, including a compromised site linked to a 2025 campaign. Apple and Google have addressed all vulnerabilities exploited in this attack, with patches applied to older iOS versions. The incident underscores the risks of n-day exploits in zero-click scenarios and the importance of timely software updates to mitigate such threats.