Sekoia’s threat detection team says a Russia-linked group quietly emptied WhatsApp and Telegram databases, saved passwords and photo libraries from iPhones that had not been updated. Nothing asked the victim to approve a download or tap a prompt. Loading a booby-trapped web page was enough, and the stolen material flowed to attacker servers within moments of the page opening.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
Sekoia published its report on Nov. 4, 2026, after spotting the operation in mid-October. The firm assesses with moderate to high confidence that the group is APT29, also tracked as Midnight Blizzard and Cozy Bear, which it ties to Russia’s foreign intelligence service, the SVR. All of the flaws abused had already been fixed by Apple and Google before the campaign began.
A watering hole that profiles each visitor
The operation was a watering hole: instead of sending messages to targets, the attackers compromised or cloned sites that targets already visit. A first-stage JavaScript file inspected each visitor’s device and browser version, then the command server handed back an exploit chain built for that exact model, which BleepingComputer described as running without user interaction. Anyone who simply arrived at the page on a vulnerable phone was the target.
Compromised sites included a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site, according to the report. Lookalike domains impersonated the official America250 site and the Raffles London hotel at The OWO, relaying genuine content so nothing looked wrong. A separate supply-chain break hit Plerdy, a Ukrainian analytics provider whose SEO tracker was altered and then loaded by thousands of mostly Ukrainian sites between Aug. 27 and Sept. 3.
The wording matters. Visiting a page is still an action, so the zero-click label means no extra tap, no file to open and no permission prompt once the page loads. The adversary-in-the-middle design made that first visit easy to trigger, since a mirrored America250 or hotel page served the real content while the exploit ran in the background. The Android chain covered Chrome 139 through 145 except version 143, the kind of narrow targeting a profiling script allows.
Three exploit chains and what each one took
Sekoia sorted the tooling into three classes. Class A hit iOS 16.7 and used CVE-2025-43529, a WebKit memory flaw, plus CVE-2024-27834 to defeat pointer authentication; it only stole browser cookies. Class B hit iOS 18.5 and chained five bugs, including a sandbox escape and a kernel read-write flaw, to run the DarkSword kit. Class C targeted Chrome for Android versions 139 through 145, excluding 143, with CVE-2026-3910 and an Adreno GPU sandbox escape.
The iOS 18.5 chain was the most invasive. It pulled SMS and iMessage, WhatsApp and Telegram databases, Keychain passwords and tokens, contacts, call history, notes, location caches, Health data, iCloud Drive files and the full photo library. The Android chain was narrower, collecting Chrome cookies, saved logins and history along with Wi-Fi configuration files. None of the final payloads installed anything that survives a restart, so a reboot cut off the access until the phone visited an infected site again.
The WebKit flaw has a history. Qualys’s write-up of CVE-2025-43529 records that Apple patched it in iOS 26.2 and iOS 18.7.3 in December 2025 after describing exploitation in an extremely sophisticated attack on specific individuals. A vulnerability tracker’s entry shows a U.S. alert on Dec. 15, 2025, a Jan. 5, 2026 remediation due date for federal agencies, and fixes in Safari 26.2, macOS Tahoe 26.2 and the other 26.2 releases. Put differently, the bug had been public and patched for roughly ten months when the campaign surfaced, which is what makes the label n-day rather than zero-day. The Chrome bug, per the National Vulnerability Database, affected versions before 146.0.7680.75 and went onto the federal catalog of actively exploited vulnerabilities on March 13, 2026.
Attribution to APT29 and the open question of who supplied the exploits
Sekoia’s confidence level is not certainty, and the report says why. Infrastructure was spread across several hosting providers and included a Cobalt Strike configuration pattern previously seen in APT29 work. A CERT partner connected leftover files on one compromised site to a separate 2025 APT29 watering hole, and Google’s Threat Analysis Group saw similarities to a 2024 campaign against Mongolian government sites. That earlier operation filtered its victims; this one did not.
The unanswered question is supply. Sekoia notes that the exploits most likely came from a third party, plausibly a commercial surveillance vendor, and that how APT29 obtained them remains unclear. The report’s authors, Amaury Garçon, Félix Aimé, Robin Kwiatkowski and the Threat Detection and Research team, state the practical upshot plainly: a user running an up-to-date operating system is safe from these attacks.
That leaves a measurable gap. Phones stuck on iOS 16.7, 18.5 or older Chrome builds were the ones exposed, and the fixes reached back to older iOS releases as well. Owners of devices that can no longer take updates have no equivalent protection, and Sekoia’s findings give no count of how many phones were actually compromised. The data-theft tooling it recovered shows what a single visit to the wrong page could cost on an unpatched device.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Doctors warn a silent liver disease now affects one in three American adults
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
