Hackers planted code on legitimate websites, including one belonging to a U.S. chemical industry trade association, that silently attacked visitors’ iPhones and Android phones running outdated software, according to research from French security firm Sekoia reported by BleepingComputer Wednesday. Sekoia attributes the campaign to APT29, a Russian group, a finding that puts staff phones that lag on updates squarely in the path of state espionage.
What Happened
Sekoia describes a “watering hole” operation, in which attackers compromise sites a target audience already trusts and wait for visitors. Code on those pages identified each visitor’s device and browser, then delivered a matching chain of exploits without any user interaction, BleepingComputer reported. BleepingComputer did not name the trade association.
Other compromised sites included a Ukrainian gas producer and a Bulgarian military-related site, with affected sites in the U.S., Ukraine, the Czech Republic and Bulgaria. Sekoia said the attackers also compromised a web analytics tracker from Ukrainian firm Plerdy, which thousands of mostly Ukrainian sites load, for about a week from late August into early September. A lookalike of the website of America250, the U.S. 250th-anniversary initiative, relayed the real site’s content.
The exploits targeted older iPhone software and versions of Chrome for Android. On iPhones running iOS 18.5, the payload harvested WhatsApp and Telegram databases, saved passwords, location data and photos, according to Sekoia. The malware did not survive a restart.
Sekoia assesses with moderate to high confidence that APT29, also tracked as Midnight Blizzard and widely attributed to Russia’s Foreign Intelligence Service (SVR), ran the campaign.
Why It Matters
All the flaws used were “n-day” bugs, meaning they had already been publicly disclosed and fixed by Apple and Google, with fixes reaching even older iOS releases, BleepingComputer reported. The exposure is therefore a patching problem: executives and staff who postpone updates can lose messages and credentials simply by browsing a familiar industry site. Mobile-device management, software that lets an employer enforce settings on work phones, can require updates and block out-of-date devices.
One flaw in the iPhone chain is linked to DarkSword, an exploit kit that several groups have used since at least November 2025, BleepingComputer reported. The Primary Wire reported in September that Ukraine’s cyber agency had flagged DarkSword in attacks on military phones, citing The Record.
What to Watch
Whether U.S. agencies or the targeted association comment, and who was compromised, remain open questions.
