CVE-2025-43529: Mobile attacks use patched Safari flaw

None of the three exploit chains Sekoia recovered worked on fully updated devices, but a compromised webpage could launch them automatically after a visit. CVE-2025-43529 was the iOS entry point; NVD lists Safari versions before 26.2 as affected. Here's how to check mobile versions, deploy the available fixes, and investigate potentially exposed accounts—and why rebooting is only a temporary interruption.

If your team's phones hold work credentials, the risk is data theft — cookies, messaging databases, saved logins. BleepingComputer's report, drawing on Sekoia's investigation, spells out what the payloads collected. Prioritize phones with sensitive work accounts instead of waiting for a suspicious prompt report. The recovered chains needed zero interaction after the site visit. The original write-up on bleepingcomputer.com has the full details.

Check Safari versions for CVE-2025-43529

Start by recording each phone's OS version and browser version separately. The Safari fix NVD lists isn't an instruction to install an identically numbered iOS release — keep those fields distinct. For Android, note Chrome's version alongside the device's OS update status.

Manually compare the Safari version against the NVD fix floor for CVE-2025-43529.

(function () {
  const recordedSafari = { major: 26, minor: 1 };
  const belowFix = recordedSafari.major < 26 ||
    (recordedSafari.major === 26 && recordedSafari.minor < 2);

  return JSON.stringify({
    browser: "Safari",
    recordedVersion: recordedSafari,
    vulnerability: "CVE-2025-43529",
    assessment: belowFix
      ? "Below the Safari 26.2 fix floor"
      : "At or above the Safari 26.2 fix floor"
  });
})();

Swap in the Safari major and minor numbers you verified. This is a manual comparison helper, not a device scanner, and it doesn't cover the other flaws in the campaign.

How legitimate pages became exploit delivery points

Sekoia uncovered the operation in mid-October 2026. It started with injected JavaScript on a Ukrainian gas producer's site — code that loaded an external fingerprinting script after the page finished loading. Elsewhere, attackers modified existing JavaScript files instead of the page template, including on a Bulgarian military-related site.

Replace the empty string with a defanged script URL recorded from a page template to compare it with the first reported loader without loading the script.

(function () {
  const recordedTemplateUrl = "";
  const reportedTemplateUrl =
    "hxxps://static.flux-telemetry[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js";

  return JSON.stringify({
    recordedUrl: recordedTemplateUrl,
    matchesReportedLoader: recordedTemplateUrl === reportedTemplateUrl
  });
})();

For an existing JavaScript asset, replace the empty string with its recorded, defanged script URL to check the second reported loader.

(function () {
  const recordedAssetUrl = "";
  const reportedAssetUrl =
    "hxxps://edge-ord.clouds-stacks[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js";

  return JSON.stringify({
    recordedUrl: recordedAssetUrl,
    matchesReportedLoader: recordedAssetUrl === reportedAssetUrl
  });
})();

These helpers compare manually recorded strings; they do not inspect a live page or establish device compromise.

When direct compromise wasn't an option, the operators used lookalike domains as reverse proxies. These relayed real site content while injecting malicious JavaScript. Impersonated properties included America250 and Raffles London at The OWO. A page could look perfectly legitimate while serving attacker-controlled script.

The investigation also traced requests from seemingly unrelated sites to a shared dependency: Plerdy's analytics tracker. Sekoia says the tracker was compromised between August 27 and September 3, 2026. Thousands of sites — mostly Ukrainian — loaded it, and the modified tracker forced visitors to load the fingerprinting code alongside Plerdy's legitimate script.

The fingerprinting code posted its results to a delivery endpoint and then inserted the returned text into a script element.

Fill in the empty strings with a recorded request's URL, method and content type to compare it with that delivery request without contacting the endpoint or executing its response.

(function () {
  const recordedRequest = {
    url: "",
    method: "",
    headers: { "Content-Type": "" }
  };
  const reportedEndpoint =
    "https://static.flux-telemetry.com/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1";

  return JSON.stringify({
    matchesReportedEndpoint: recordedRequest.url === reportedEndpoint,
    usesReportedMethod: recordedRequest.method === "POST",
    usesReportedContentType:
      recordedRequest.headers["Content-Type"] === "application/json"
  });
})();

That dependency changes things for web teams. Checking only your own repo misses a remotely loaded tracker altered upstream. The review needs to cover the page template, existing JavaScript assets, and every third-party script loaded in visitors' browsers.

The recovered chains stole different categories of data

Sekoia retrieved three complete exploit chains and their final payloads by testing browser profiles against the delivery endpoint. The table below shows observed delivery profiles — not a complete affected-version matrix.

Enter the category, description, path and numeric size from a captured record to compare its metadata with the cookie-collection object shown in the recovered code, without including cookie contents or a device identifier.

(function () {
  const recordedMetadata = {
    category: "",
    description: "",
    path: "",
    size: 0
  };

  return JSON.stringify({
    matchesReportedCookieMetadata:
      recordedMetadata.category === "only_cookies" &&
      recordedMetadata.description === "only_cookies" &&
      recordedMetadata.path === "only_cookies" &&
      recordedMetadata.size === 2097152
  });
})();

The distinction between browser execution and broader device access matters. Sekoia describes the fuller iOS chain moving from code execution in the web renderer through protection bypasses and sandbox escapes to kernel read/write access. A renderer compromise alone wasn't enough for comprehensive collection.

The Android chain similarly combined browser exploitation with an Adreno driver flaw. The final payload, dubbed AndroSnitch by Sekoia, collected Chrome data and saved Wi-Fi credentials — not just what the visitor typed on the compromised page.

Why an old Safari flaw still deserves patch priority

CVE-2025-43529 illustrates the core problem: a patch existing isn't the same as that patch reaching a phone. CISA rates it CVSS 3.1 8.8 (High) and added it to the Known Exploited Vulnerabilities catalog on December 15, 2025.

That catalog entry proves known exploitation — not attribution for every attack using CVE-2025-43529. Sekoia separately identified its role in the recovered iOS chains. Keep those findings distinct in any internal incident assessment.

“All three exploit chains rely entirely on known, already-patched vulnerabilities.”

— Sekoia's investigation

Sekoia says every vulnerability in those chains was fixed before the campaign started, and none of the recovered chains worked on fully updated devices. BleepingComputer confirms Apple and Google patched all targeted flaws, with fixes reaching older iOS releases.

The practical priority is deploying available updates, not waiting for a new emergency fix. NVD's Safari entry answers a specific version question — it doesn't replace verifying the OS and other browser components are current.

The investigation does not establish every visitor's exposure

Sekoia attributes the operation to APT29 (Midnight Blizzard) with moderate-to-high confidence, citing technical similarities to earlier watering-hole ops, infrastructure patterns, and a partner's assessment linking artifacts found on a compromised website to a 2025 APT29 campaign. That's an attribution assessment — not certainty about who operated every compromised page.

Plerdy's tracker reach isn't a count of compromised phones. Sekoia says it's unclear whether operators targeted specific visitors or collected broadly before filtering. A site loading the tracker and a device successfully running an exploit are different events.

A delivery profile isn't a universal vulnerability boundary. Researchers saw differences between the versions the server selected and the broader capabilities of some exploit code. Conversely, Sekoia says fully updated devices were outside the recovered chains' reach.

The term 'zero-click' needs context: these attacks still started with a website visit. The interaction-free part was the exploitation that followed. Nothing in the findings suggests an untouched, fully updated phone could be compromised just by being online.

Patch mobile fleets and review exposed sessions

1. Identify stale devices first. Collect OS and browser versions, then compare against the latest security updates for each device. Treat Safari 26.2 as the listed fix for CVE-2025-43529 — not a campaign-wide all-clear.

2. Update the OS and browser. Since the Android chain also used an Adreno driver flaw, I wouldn't mark an Android phone cleared just because Chrome updated. Check the device's available security updates too.

3. Use a restart as temporary containment where exposure is suspected. Sekoia found no persistence in the recovered payloads, so rebooting stops their activity. But visiting a compromised site again restarts the attack — apply updates before returning.

4. Investigate what may have already left the device. Given the reported theft of cookies and credentials, I'd review potentially exposed accounts, invalidate relevant sessions, and replace affected credentials where warranted. A restart doesn't mean stolen data or credentials are suddenly harmless.

For website owners, inspect templates and existing JavaScript files for unexpected inclusions, and review third-party tracker loading during the Plerdy compromise window. Sekoia identified static.flux-telemetry[.]com as a delivery host and ad.starx-net[.]com as an exfiltration destination — investigation leads, not an exhaustive inventory.

Fully updated devices don't need a campaign-specific workaround for the chains Sekoia analyzed. But rebooting an unpatched phone leaves the underlying route wide open.