Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes

Russia-linked APT29 (Midnight Blizzard) compromised legitimate websites and injected malicious code through a hijacked web analytics service to silently deliver exploit chains targeting known but unpatched vulnerabilities on iOS and Android devices. The use of n-day vulnerabilities — flaws with existing patches — means that timely patching alone could have blocked the initial exploitation vector on victim devices. The supply chain angle amplifies the threat significantly, as even cautious users visiting trusted sites were exposed without any direct interaction with obviously malicious content. This campaign demonstrates how adversaries chain together third-party trust relationships and delayed patching to maximise reach and deniability. The ultimate harvest of credentials and personal data from mobile devices underscores the high-value impact of leaving known vulnerabilities unaddressed.