---
title: Russian APT29 Group Steals Data via Zero-Click Exploits on Android and iOS
url: https://www.dataloco.com/en/russian-apt29-group-steals-data-via-zero-click-exploits-on-android-and-ios
published: 2026-11-10T14:20:36+00:00
language: en
section: Security
source: https://www.punto-informatico.it/furto-dati-exploit-zero-click-android-ios/
organizations: Sekoia, APT29, Midnight Blizzard, Cozy Bear, Android, iOS
publisher: Dataloco
---

# Russian APT29 Group Steals Data via Zero-Click Exploits on Android and iOS

Researchers at Sekoia have identified a large-scale watering hole campaign targeting Android and iOS devices to steal cookies, passwords, and personal data without any user interaction. The attacks, attributed to the Russian group APT29, also known as Midnight Blizzard or Cozy Bear, exploit multiple n-day vulnerabilities in mobile operating systems.

The campaign compromises high-profile websites frequented by specific user groups, including corporate, military, and government entities in Ukraine, Bulgaria, the Czech Republic, and the United States. Attackers employed three infection vectors: injecting malicious JavaScript into legitimate site homepages, creating fake clone sites, and compromising the software supply chain. In one instance, a tainted version of the Plerdy SEO Tracker tool was distributed.

Three distinct exploit chains were utilized during the operations. The first targets iOS vulnerabilities CVE-2025-43529 and CVE-2024-27834 to extract Safari cookies. A second, more extensive chain leverages iOS flaws CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to harvest messages, emails, contacts, call logs, geolocation data, and photos. The third chain exploits Chrome on Android using vulnerabilities CVE-2026-3910 and CVE-2025-27038 to steal Wi-Fi passwords, browsing history, and cookies.

None of the attacks establish persistence on the infected devices, meaning a simple reboot halts the malicious activity. Security experts advise users to immediately install the latest operating system and browser updates, as patches for these vulnerabilities are currently available.

## This story in other languages

- [中文](https://www.dataloco.com/zh/story-100)
- [日本語](https://www.dataloco.com/ja/androidios)
- [Indonesia](https://www.dataloco.com/id/serangan-cyber-melalui-eksploitasi-zero-click-pada-android-dan-ios)
- [Türkçe](https://www.dataloco.com/tr/rus-siber-saldirganlar-android-ve-ios-cihazlardan-sifir-tiklamali-aciklarla-veri-caliyor)
- [हिन्दी](https://www.dataloco.com/hi/android-oura-ios-para-shanaya-kalka-kamajaraya-ka-mathhayama-sa-data-cara-ka-abhayana)
- [한국어](https://www.dataloco.com/ko/ios)
- [Deutsch](https://www.dataloco.com/de/russische-hacker-nutzen-zero-click-exploits-gegen-android-und-ios)
- [Español](https://www.dataloco.com/es/campana-de-robo-de-datos-sin-interaccion-del-usuario-en-android-e-ios)
- [Polski](https://www.dataloco.com/pl/kradziez-danych-za-pomoca-exploitow-zero-click-na-systemy-android-i-ios)
- [العربية](https://www.dataloco.com/ar/mgmoaa-tgss-rosy-tnfth-hgmat-akhtrak-don-tfaaal-lsrk-byanat-mn-aghz-androyd-oay-ao-as)
- [Nederlands](https://www.dataloco.com/nl/onderzoekers-onthullen-grootschalige-zero-click-aanval-die-android-en-ios-apparaten-aanvalt)
- [Norsk](https://www.dataloco.com/no/russisk-gruppe-utnytter-android-og-ios-sarbarheter-for-a-stjele-data)
- [Русский](https://www.dataloco.com/ru/obnaruzena-kraza-dannyx-cerez-eksploity-s-nulevym-klikom-dlia-android-i-ios)
- [עברית](https://www.dataloco.com/he/android-ios)
- [Français](https://www.dataloco.com/fr/une-campagne-despionnage-ciblant-les-systemes-android-et-ios)