APT29 Conducts Watering Hole Campaign Against iOS and Android Users

# APT29 Conducts Watering Hole Campaign Against iOS and Android Users

https://gcdradar.vercel.app/incidents/apt29-conducts-watering-hole-campaign-against-ios-and-androi · AIR-2026-1763 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild against targets.
- Fix status: No fix needed
- First reported: 2026-11-04 (happened 2026-10-15)
- AI role: No AI role
- Products: iOS, Android

## Summary

APT29 used compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with n-day exploits. The campaign stole cookies, messages and Wi-Fi passwords from targeted mobile devices.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-05: Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign (https://therecord.media/russia-hackers-smartphone-cyberattacks)
- 2026-11-05: Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes (https://securityweek.com/russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes)
- 2026-11-04: Hackers use n-day exploits in zero-click attacks on iOS, Android devices (https://bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices)
- 2026-11-04: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits (https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html)
- 2026-11-04: Russian hackers target iOS and Android users with n-day exploits (https://helpnetsecurity.com/2026/11/04/apt29-watering-hole-mobile-devices-n-day-exploits)

## Sources

- 2026-11-04 Help Net Security: Russian hackers target iOS and Android users with n-day exploits https://helpnetsecurity.com/2026/11/04/apt29-watering-hole-mobile-devices-n-day-exploits
- 2026-11-04 The Hacker News: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html
- 2026-11-04 BleepingComputer: Hackers use n-day exploits in zero-click attacks on iOS, Android devices https://bleepingcomputer.com/news/security/hackers-use-n-day-exploits-in-zero-click-attacks-on-ios-android-devices
- 2026-11-05 SecurityWeek: Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes https://securityweek.com/russia-linked-hackers-hit-ios-android-devices-with-exploit-chains-via-watering-holes
- 2026-11-05 The Record: Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign https://therecord.media/russia-hackers-smartphone-cyberattacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.