Midnight Blizzard targets mobile devices with exploit chains

Securityweek reports that the Russian state-sponsored threat actor Midnight Blizzard, also known as APT29, Cozy Bear, The Dukes, Nobelium and Yttrium, is believed to have targeted iOS and Android users in Europe and the United States via a large watering hole campaign. Sekoia identifies three exploit chains used across the operation: two for iOS and one for Android, all targeting previously patched vulnerabilities.

The iOS chains reimplement the DarkSword exploit kit’s initial remote code execution for arbitrary read/write, then exploit CVE-2024-27834 to bypass Apple’s Pointer Authentication Codes and execute code that harvests cookies outside of Safari. CVE-2024-27834 was patched in iOS 17.5/iPadOS 17.5, iOS 16.7.8/iPadOS 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5; CISA added it to its KEV catalog with a two-week patch directive for federal agencies.

The Android chain targets CVE-2026-3910, a Chrome vulnerability patched as a zero-day in March 2026, and CVE-2025-27038, a Qualcomm flaw patched with Android’s August 2025 security update. The final payload, AndroSnitch, exfiltrates Chrome-stored data such as cookies, account information, passwords, browser history and Wi‑Fi passwords. Sekoia notes that the campaign included compromises or clones of US, Ukrainian, Czech and Bulgarian sites, with a supply‑chain touch on the Ukrainian web analytics service Plerdy.

The operators registered lookalike domains acting as reverse proxies to deliver the exploits in an adversary‑in‑the‑middle setup, potentially aiming at diplomatic circles and high‑profile guests.