APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
Executive Summary
Executive Summary In late 2026, APT29 (Midnight Blizzard), a Russian state-sponsored threat group, executed a large-scale watering hole campaign targeting iOS and Android users across the U.S., Ukraine, Czech Republic, and Bulgaria. Attackers compromised legitimate high-profile websites and created lookalike domains to deliver JavaScript profiling payloads that fingerprinted visitor devices and browser versions. Based on device type, a tailored n-day exploit chain was silently deployed—requiring zero user interaction—to harvest Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, and Chrome login data. The campaign also subverted the Plerdy Ukrainian web analytics tracker, briefly exposing thousands of downstream sites.
This campaign underscores a critical shift in nation-state tradecraft: supply chain compromise of analytics scripts combined with zero-click mobile exploitation eliminates traditional phishing dependencies entirely. As mobile devices become primary endpoints for sensitive communications, credential theft via browser-level n-day exploits represents a rapidly escalating threat vector that bypasses conventional endpoint defenses.
Why This Matters Now
Why This Matters NowZero-click mobile attacks using n-day exploits are accelerating in 2026, with APT29 demonstrating that patching delays of even a few weeks create exploitable windows at scale. Organizations relying on mobile devices for enterprise communications—especially those in government, defense, energy, and finance—face immediate credential and data exfiltration risk with no user action required, dramatically shrinking detection and response windows.
Attack Path Analysis
Attack Path AnalysisAPT29 (Midnight Blizzard) executed a large-scale watering hole campaign by compromising legitimate high-profile websites and injecting JavaScript profiling code that fingerprinted visiting iOS and Android devices, then delivered platform-specific n-day exploit chains without user interaction. The attack progressed from silent device profiling through browser/OS exploit chains to credential and data harvesting, with exfiltration of cookies, messaging app databases, keychain credentials, location data, and photos — all without establishing persistence, making detection difficult and attribution-delayed.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAPT29 compromised legitimate websites (Ukrainian gas producer site, U.S. chemical trade association, Bulgarian military site) and created lookalike domains impersonating America250 and Raffles London. They also tampered with the Plerdy Ukrainian web analytics SEO tracker, which was loaded by thousands of sites. Injected JavaScript profiled visiting devices — browser version, OS, platform — enabling the C2 to select the correct n-day exploit chain for each victim without any user click or interaction.
Related CVEs
Related CVEsCVE-2024-27834
CVSS 5.5A vulnerability in WebKit on Apple iOS 16.x allows an attacker to bypass pointer authentication, potentially enabling arbitrary code execution via maliciously crafted web content in Safari without user interaction.
Affected Products:
Apple iOS – < 16.7.8, < 17.5
Apple Safari – < 17.5
Exploit Status:
exploited in the wildCVE-2025-27038
CVSS 7.5A use-after-free vulnerability in Qualcomm components used in Android devices allows a local or remote attacker to escalate privileges or execute arbitrary code, exploited in targeted attacks against Chrome for Android users.
Affected Products:
Google Android – Chrome for Android 139 to 145 (excluding 143)
Qualcomm Various Snapdragon chipsets – Multiple affected firmware versions
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesDrive-by Compromise
Exploitation for Client Execution
Browser Session Hijacking
Steal Web Session Cookie
Unsecured Credentials
Adversary-in-the-Middle
Transmitted Data Manipulation
Exfiltration Over C2 Channel
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
CISA Zero Trust Maturity Model 2.0 – Device Health and Posture Validation
Control ID: Device Pillar – Visibility and Analytics
NIS2 Directive – Mobile Endpoint Security and Vulnerability Management
Control ID: Article 21 – Security of Network and Information Systems
GDPR – Technical Measures for Personal Data Protection
Control ID: Article 32 – Security of Processing
PCI DSS 4.0 – Security Vulnerabilities Are Identified and Addressed
Control ID: Requirement 6.3
DORA (Digital Operational Resilience Act) – ICT Asset and Threat Exposure Management
Control ID: Article 8 – ICT Risk Management
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
APT29's zero-click infostealer campaign targeting government-linked sites directly threatens credential theft, cookie harvesting, and Keychain data exfiltration from officials' iOS and Android devices, demanding immediate egress security and encrypted traffic controls.
Oil/Energy/Solar/Greentech
A compromised Ukrainian gas producer site served as a watering hole delivery vector, exposing energy sector employees to n-day exploit chains harvesting WhatsApp databases, credentials, and location data via CVE-2025-43529 and related vulnerabilities.
Military Industry
A Bulgarian military-related site was confirmed compromised in this APT29 campaign, enabling zero-click credential and messaging database exfiltration from personnel devices, with critical compliance gaps across NIST.800-53.SC-7 and ZTMM segmentation controls.
Information Technology/IT
IT sector faces systemic risk as thousands of sites loading compromised Plerdy analytics JavaScript were weaponized for device profiling and exploit chain delivery, exposing lateral movement and C2 blind spots requiring multicloud visibility and inline IPS remediation.
Sources
Sources- Hackers use n-day exploits in zero-click attacks on iOS, Android deviceshttps://www.bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices/Verified
- NVD - CVE-2024-27834https://nvd.nist.gov/vuln/detail/CVE-2024-27834Verified
- NVD - CVE-2025-27038https://nvd.nist.gov/vuln/detail/CVE-2025-27038Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Sekoia - Poisoned Source: APT29 Watering Holes Target Mobile Devices with N-Day Exploitshttps://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploitsVerified
- Apple Security Updates - iOS 16.7 and iOS 17.5https://support.apple.com/en-us/111900Verified
- Android Security Bulletin - Qualcomm Component Patcheshttps://source.android.com/docs/security/bulletinVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to this incident because APT29's campaign relied on unmonitored outbound paths, unconstrained east-west reachability, and invisible C2 callbacks to complete credential theft at scale. By enforcing segmented access, controlled egress, and identity-aware routing across cloud-connected workloads, CNSF would likely reduce the blast radius of downstream credential abuse and limit attacker reachability into enterprise environments accessed via stolen mobile credentials.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF's visibility layer would likely surface anomalous outbound connection patterns from enterprise-managed endpoints reaching compromised or lookalike domains, reducing the window in which silent profiling activity goes undetected and constraining the attacker's ability to complete device fingerprinting unobserved.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain the downstream reachability of any credentials or session tokens harvested from compromised devices, reducing the scope of access an attacker could exercise against cloud workloads or enterprise segments even after successful privilege escalation on the endpoint.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely reduce the reachability of any attacker attempting to leverage stolen credentials for lateral movement across cloud-hosted segments, limiting how deeply compromised device credentials could translate into traversal paths between workloads or accounts within the enterprise environment.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely surface repeated exploit-serving response patterns and unusual outbound callback sequences from enterprise-managed devices, reducing the attacker's ability to operate C2 channels undetected across cloud-connected network paths and constraining the window for silent payload delivery.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies enforcing FQDN filtering and encrypted traffic inspection would likely reduce the effectiveness of transient data exfiltration to attacker-controlled endpoints, constraining unauthorized outbound data transfers by limiting which destinations enterprise-connected devices are permitted to reach during an active session.
Because prior CNSF controls would likely have constrained outbound paths, reduced east-west reachability of stolen credentials, and limited C2 delivery windows, the residual impact would likely be scoped to a smaller set of affected devices and a narrower range of usable credential access rather than broad enterprise exposure.
Impact at a Glance
Affected Business Functions
- Mobile Device Security and Endpoint Integrity
- User Credential and Authentication Management
- Messaging and Communication Platform Confidentiality
- Web Analytics and Digital Supply Chain Trust
Estimated downtime: N/A
Estimated loss: N/A
The campaign targeted individual iOS and Android device users across multiple countries including the U.S., Ukraine, Czech Republic, and Bulgaria. Confirmed data exfiltration categories include: Safari browser cookies, WhatsApp and Telegram message databases, Apple Keychain credentials (usernames and passwords), device location data, photos, Chrome browser cookies, Chrome saved login data, Chrome browsing history, and saved WiFi network credentials. The compromise of Plerdy web analytics JavaScript exposed potentially thousands of Ukrainian websites and their visitors to profiling and exploit delivery between August 27 and September 3. Given the APT29 attribution and espionage motivation, the highest-value targets likely include government officials, diplomats, journalists, and NGO personnel operating in geopolitically sensitive regions. No persistence mechanism was established, meaning data theft was session-based and required re-visiting a compromised site for repeated exploitation.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with up-to-date signatures covering known CVE exploit patterns (CVE-2025-43529, CVE-2026-3910, etc.) on enterprise network egress points to detect and block exploit payload delivery when mobile devices connect through managed infrastructure such as corporate WiFi or VPN.
- • Enforce Egress Security and Policy Enforcement with FQDN-based filtering and outbound traffic controls to detect and block unauthorized data exfiltration to attacker-controlled C2 infrastructure, particularly anomalous POST requests carrying encoded credential or database content from managed or BYOD mobile endpoints.
- • Apply Encrypted Traffic (HPE) protections including TLS inspection on outbound enterprise traffic paths to ensure that exfiltration channels leveraging HTTPS to lookalike or compromised domains are inspectable and blockable, preventing data in transit from reaching unauthorized destinations.
- • Leverage Multicloud Visibility and Control capabilities to baseline normal outbound traffic patterns from enterprise-managed mobile devices and flag anomalous callback sequences, repeated exploit-serving HTTP responses, or connections to newly registered or low-reputation domains consistent with watering hole C2 infrastructure.
- • Implement Zero Trust Segmentation with identity-based policies to restrict mobile device access to sensitive enterprise resources (cloud apps, internal APIs, credential stores) so that even if a device is compromised via a browser exploit chain, the blast radius is contained and harvested credentials cannot be immediately leveraged for lateral access into cloud workloads or enterprise services.
