Sekoia ties mid-October mobile campaign to APT29

In mid-October 2026, Sekoia’s threat detection researchers spotted a watering-hole campaign aimed at iPhone and Android users. The attackers used compromised websites, lookalike domains and a hijacked Ukrainian analytics service. The French cybersecurity company named the activity Poisoned Source and published its research on November 4, 2026.

Sekoia rates its confidence in the APT29 link as moderate to high. The group is also known as Midnight Blizzard and Cozy Bear and is tied to Russia’s Foreign Intelligence Service. Sekoia assessed that APT29 or at least one of its subgroups is behind the campaign.

Sekoia’s attribution rests on evidence from a 2025 watering-hole intrusion on a compromised site, parallels to a 2024 campaign against Mongolian government sites confirmed by Google TAG, and a concentration of victims in Ukraine. Garçon said attribution is further supported by TTPs matching the 2024 Mongolian government campaign, the operator’s use of multiple autonomous systems, and victimology aligned with Russian strategic interests.

Three routes drove the campaign: malicious JavaScript injected into legitimate websites, lookalike domains serving as intermediaries, and attackers seizing control of Plerdy. Attackers compromised the Ukrainian analytics service and served malicious code through its tracking script for one week between Aug. 27 and Sept. 3, 2026. They injected code into the file a.plerdy[.]com/public/js/click/main.js.

Thousands of sites run the tracking script, and most of them are Ukrainian. They include pages used by the army, special forces and military equipment manufacturers. The week-long compromise exposed hundreds of mostly Ukrainian websites and their visitors to the exploit kit.

The attackers used america250[.]holiday to mirror the America250 independence initiative. They also used theowo[.]club to mirror Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street. Researchers citing open-source reporting say the Ukrainian president stayed at the Raffles London at The OWO during an October 14 visit. A non-partisan group that includes lawmakers, business executives and at least one former Trump administration member owns America250.org.

According to Sekoia researchers, the intrusion set may have deliberately selected america250.org because of its association with a high-profile national celebration, using it as a pretext for invitation-themed spear-phishing campaigns. “We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration”

The initial JavaScript payload profiles the visitor’s browser and device, then the delivery system sends platform-specific exploit chains for already patched flaws with no action required from the visitor. None of the payloads established persistence on the device, and a reboot stops the malicious activity until the user visits a compromised site again. Every exploit targeted had already received a patch before the campaign began, and Sekoia said users with current operating systems are not vulnerable to these attacks. “a user running an up-to-date operating system is safe from these attacks.”

For iPhones running iOS 16.7, attackers used CVE-2025-43529 and CVE-2024-27834 to take cookies stored in Safari. On iOS 18.5 iPhones, the DarkSword exploit kit chain used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to harvest messages, Keychain credentials, location, health information, photos and other device data.

CVE-2025-43529 is tied to the DarkSword exploit kit, first documented in March. Threat groups have used it in attacks going back to at least November 2025.

Attackers hit Android phones running Chrome versions 139 through 145, excluding version 143, using CVE-2026-3910 and CVE-2025-27038. The payload collected Chrome cookies, login data, browsing history and Wi-Fi passwords via AndroSnitch. The Android Class C chain achieves remote code execution, sandbox escape and privilege escalation before delivering AndroSnitch. If the device is a Samsung Galaxy S25 Ultra with model identifier SM-S938B, the attack chain terminates exploitation.

The AndroSnitch payload takes its name from ANDROSNATCH, a Chrome cookie-stealing payload that Google documented in August 2024 during a suspected APT29 Mongolian government watering-hole campaign using CVE-2024-5274 and CVE-2024-4671. Exfiltrated data from all three exploit chains went to the endpoint ad.starx-net[.]com:8881/telemetry/v12. Sekoia found four vulnerabilities in unreachable code or alternate exploit paths, and they were not used in the analyzed chains.

Researchers could not determine whether the goal was to hit visitors of chosen sites or to infect broad numbers of unpatched phones and tablets indiscriminately. Some of the affected sites probably draw visitors who are valuable or strategically important because of the Russia-Ukraine war, researchers said. Sekoia assesses with low confidence that an Australian medical clinic and other sites with no clear strategic value may have targeted specific individuals. Unlike a 2024 APT29 operation on Mongolian government sites that used a hardcoded filter, the 2026 campaign had no hardcoded filter and collected any cookies in the browser.

Sekoia researchers Amaury-Jacques Garçon and Félix Aime said the injected JavaScript collects browser and device attributes before the delivery infrastructure serves platform-specific N-day exploit chains, which use known, already-patched flaws. Garçon said the scattered targets reflect individual-centric targeting, where attackers compromise specific sites that a person of interest visits. Researchers found delivery servers by matching a filename the actor reused for its malicious JavaScript across the whole campaign.

Compromised legitimate websites included a far-right European political party, a Bulgarian military-related organization, an Australian medical clinic, a Ukrainian gas production company and a US chemical industry trade association. Other exposed sites included a Ukrainian gas producer, Ukrainian military and military equipment websites, a US chemical-industry trade association site, a Czech far-right movement site and a Bulgarian military-related site. At the start of the attacks, iPhone or Android users potentially visited hundreds of different sites. Using URLScan, PublicWWW, URLQuery, Censys and Shodan, researchers found that victims across all three infection vectors pointed to the same delivery infrastructure, with many victims.

Stolen browser authentication cookies open corporate webmail, internal web portals and cloud-based collaboration suites without requiring a password or multifactor authentication. Stolen social media and text logs and contacts enable spear-phishing, and other stolen secrets lead to account takeovers or network-level access. The actor focuses solely on intelligence collection rather than persistence. The compromises serve as a stepping stone for identity and cloud-based intrusions.

Sekoia is working with computer emergency response teams in affected countries, including CERT-UA, to identify victims and disrupt the watering-hole infrastructure. Sekoia contacted 25 providers and hosting firms to remove malicious domains and IP addresses tied to the campaign. Sekoia contacted Ukraine’s CERT-UA and an unnamed partner organization. Their joint investigation confirmed traces on one compromised website matched a 2025 watering-hole campaign attributed to the same Russian group.

Google TAG documented intrusion efforts from November 2023 through July 2024. The efforts used already patched flaws against iPhone and Android users via Mongolian government sites. Google TAG observed three waves in November 2023, February 2024 and July 2024. Google TAG assessed with moderate confidence that APT29, also tracked as Cozy Bear and Nobelium, carried out the earlier intrusions.

CVE-2023-41993, an Apple WebKit bug credited to Bill Marczak of Citizen Lab and Maddie Stone of Google TAG, was used in the earlier 2024 attacks. Citizen Lab research from September said CVE-2023-41993 and other flaws were being used by Cytrox’s Predator spyware. During the November 2023 campaign, Mongolian state websites cabinet.gov[.]mn and anmfa.gov[.]mn served an iframe carrying the WebKit vulnerability to iPhone users on iOS 16.6.1 or older.

In February 2024, attackers used a poisoned iframe on Mongolian state site mfa.gov[.]mn with the same WebKit flaw against iPhone users on iOS 16.6.1 or older. They added webmail.mfa.gov[.]mn/owa/auth to the poisoned site list. In July 2024, the attack redirected Android users from mfa.gov[.]mn to https://track-adv[.]com/analytics.php?personalization_id=<random number> and deployed a Chrome exploit chain targeting CVE-2024-5274 and CVE-2024-4671.

NSO Group exploited CVE-2024-5274 as a zero-day in May. Intellexa exploited CVE-2023-41993 as a zero-day the previous September. The first exploiter of CVE-2024-4671, disclosed May 9, is unclear. The intrusions relied on exploits closely resembling tools deployed by commercial surveillance vendors Intellexa and NSO Group.

The APT29 exploit strongly resembled an Intellexa exploit for CVE-2021-37973, an older Chrome sandbox escape flaw. Google notified Mongolian CERT to remediate infected websites and notified Apple, Android and Chrome partners when researchers discovered the campaigns.

A Google spokesperson said Google does not believe APT29 was first to exploit Chrome flaws CVE-2024-5274 and CVE-2024-4671, which were initially exploited as zero-days. Google TAG had observed the cookie-stealing framework in a suspected APT29 campaign in 2021, the first time researchers had observed it since that campaign.

Sekoia researchers concluded that the group likely acquired the exploits from an outside supplier. Sekoia’s analysis supported the view that APT29 obtained the exploits from a third party. Sekoia suspects the DarkSword toolkit originated from a commercial surveillance vendor.

Sekoia said nation-state groups keep reusing packaged mobile exploit toolkits such as DarkSword from commercial surveillance vendors. That reuse reduces the cost and skill needed for advanced phone attacks. Microsoft reported earlier in the summer that the group had taken over hotel and conference center Wi-Fi networks for months. The group used them to get Microsoft 365 login credentials and distribute malware.

Sekoia’s researchers did not disclose a figure for compromised devices. The company published its research on the campaign on November 4, 2026.