Just Visiting the Wrong Website Was Enough: A Watering-Hole Campaign Used Already-Patched Bugs to Raid Unupdated Phones
Researchers tie a large watering-hole operation to Russia’s APT29. Booby-trapped and lookalike websites fingerprinted visitors and pushed exploit chains for older iPhones and Chrome on Android, with no tap required. The fixes already exist.
No suspicious link, no attachment, no app to install. In a campaign described by researchers at Sekoia, simply loading a compromised or fake web page on an out-of-date phone was enough to hand over cookies, saved logins and messaging data. Every flaw involved had already been patched by Apple and Google, which is exactly why the attackers chose them.
This rundown is based on BleepingComputer’s coverage of Sekoia’s findings.
The campaign at a glance
- Attribution: APT29, also known as Midnight Blizzard, assessed by Sekoia with moderate-to-high confidence based on past watering-hole tradecraft and infrastructure overlaps.
- Bait sites: legitimate sites that had been compromised (including a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related site) plus lookalike domains impersonating the America250 site and a London hotel, relaying the real content in an adversary-in-the-middle setup.
- Wider reach: the attackers also tampered with the SEO tracker of the Ukrainian web analytics service Plerdy, which was loaded by thousands of websites between August 27 and September 3.
- First stage: JavaScript that profiled each visitor’s device and browser version so the server could pick a matching exploit chain.
- Targets: iPhones on iOS 16.7 and iOS 18.5, and Chrome for Android versions 139 to 145 (except 143).
- What was taken: Safari cookies on the older iOS chain; WhatsApp and Telegram databases, Keychain credentials, location data and photos on the iOS 18.5 chain; Chrome cookies, saved logins, browsing history and saved Wi-Fi credentials on Android.
- Persistence: none. A reboot stopped the activity until the device visited a malicious page again.
- Status: all of the exploited flaws are patched, including on some older iOS releases.
Why ‘n-day’ matters
An n-day is a vulnerability that is already public and fixed. It costs attackers far less than a brand-new zero-day, and it works for as long as people delay updates. One of the iOS flaws in this campaign is linked to an exploit kit that multiple groups have used since at least late 2025. For an attacker, the pool of unpatched phones is the opportunity.
Why a phone breach is a business breach
The data on the list is exactly what lets someone step into a work identity: browser session cookies can skip a password and a one-time code, saved credentials open business apps, and messaging databases reveal who talks to whom. A phone that checks work email is part of your network, whoever paid for it.
Quick checklist
- Install the latest iOS and Android security updates, and update Chrome on Android.
- Turn on automatic updates for the operating system and the browser.
- Restart phones regularly; with no persistence, a reboot clears this kind of implant.
- Retire or isolate devices that can no longer get security updates.
- Require a minimum OS version before a phone can reach company email and apps.
What this means for your company
Most small businesses never set phone update rules because the phones feel personal. This campaign shows why that gap matters: the attacker did not need anyone to make a mistake, only an old operating system. A simple policy (supported OS versions only, updates within a set number of days, and a check at sign-in through whatever device management or conditional access tools you already have) closes most of the window. Pair it with short session lifetimes for sensitive apps so stolen cookies age out quickly.
Do you know how many phones touching your company email are running an out-of-date operating system right now? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
