Hackers use n-day exploits in zero-click attacks on iOS, Android devices

Key Points:

• A large-scale watering hole attack linked to Russian hacker group APT29 targeted iOS and Android users through compromised or fake high-profile websites in the U.S., Ukraine, the Czech Republic, and Bulgaria, profiling visitors to deploy platform-specific exploits without user interaction.
• Compromised legitimate sites included a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site, while lookalike domains impersonated official sites like America250 and Raffles London at The OWO hotel, using an adversary-in-the-middle attack model.
• The threat actors also compromised Ukrainian web analytics service Plerdy, modifying its SEO tracker used by thousands of websites, primarily in Ukraine, to deliver the initial JavaScript payload that profiles devices and browsers.
• Exploited vulnerabilities targeted iOS (versions 16.7 and 18.5) and Chrome for Android (versions 139 to 145), harvesting cookies, messaging app databases, credentials, location data, photos, and WiFi information, with some exploits linked to the “DarkSword” exploit kit.
• Researchers noted that the malware did not establish persistence, meaning a device reboot would halt the attack until the victim revisited a compromised site, and attributed the campaign to APT29 based on operational similarities, infrastructure overlaps, and links to previous campaigns.