Researchers at Sekoia have documented a watering hole campaign that profiles every visitor to a compromised website, then serves an exploit chain tailored to that device. Nothing is clicked and nothing is installed by the user: the payload runs from the page itself.
What happened
Several high-profile websites in the United States, Ukraine, the Czech Republic and Bulgaria were compromised or impersonated to host a single profiling script. That script fingerprints the browser and version, and then serves a platform-specific chain of already-patched exploits.
On iPhones the chain leans on CVE-2025-43529, a WebKit flaw where processing maliciously crafted web content can lead to arbitrary code execution, alongside older iOS flaws. One variant takes Safari cookies. A second takes WhatsApp and Telegram databases, Keychain credentials, location data and photos.
On Android the chain pairs CVE-2026-3910, an inappropriate implementation in Chrome's V8 engine fixed in 146.0.7680.75, with a Qualcomm flaw, and drops the AndroSnitch infostealer to collect Chrome cookies, saved logins, browsing history and stored WiFi credentials.
Sekoia attributes the operation to APT29, the Russian group also tracked as Midnight Blizzard, with moderate-to-high confidence. Every flaw in the analysed chains has been patched by Apple and Google, which is precisely why this campaign works: it hunts devices that were never updated.
Who is affected
- iPhones and iPads on iOS or iPadOS below 18.7.3 or below 26.2, which is where the WebKit fixes land
- Android phones running Chrome for Android 139 to 145, with the exception of 143, where the Chrome and Qualcomm fixes are missing
- Any organisation whose staff browse personal or work sites on a phone that is months behind on updates, including BYOD handsets that never touch your MDM
What to do now
Treat an out-of-date phone as an exposed endpoint, not a personal device. Update iOS and Chrome for Android this week, then check what the device could have handed over.
- Push the latest iOS and iPadOS release to every managed iPhone and iPad; on older hardware, confirm the 18.7.x security branch is installed
- Force Chrome for Android to 146.0.7680.75 or later, and check that Play Store auto-update has not been deferred on staff handsets
- On any phone that ran old firmware while browsing news or government sites, re-authenticate WhatsApp and Telegram, rotate saved browser passwords and re-issue WiFi credentials
- Move staff passwords and 2FA seeds out of phone browsers and into a managed password manager, so a stolen cookie is not the whole estate
- Review identity logs for sign-ins from new locations or devices on accounts that were used on those phones
What this means for South African businesses
South African SMEs rarely get singled out by a group like APT29, and that is not the point. These watering holes are opportunistic: the profiling script does not care who you are, only whether your browser is patched, and a phone three versions behind on Chrome is a valid target for anyone who buys the same exploit chain.
The realistic risk here is a stolen session rather than a state-level intrusion. A technician's phone that hands over WhatsApp, browser cookies and WiFi credentials is a route into client environments, and most SMEs have no inventory of which phones hold that access.
If you cannot say which of your staff phones are on the current iOS and Chrome builds, that gap is worth closing before the next campaign reuses the same exploit kit.
The full technical analysis of the campaign and its attribution is in this BleepingComputer report.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.