APT29 used compromised websites to fingerprint thousands of mobile visitors

Sekoia uncovered the Poisoned Source watering-hole campaign (a tactic that infects websites targets are likely to visit) in mid-October 2026 and attributed it with moderate to high confidence to APT29, the group tracked as Midnight Blizzard and Cozy Bear. The US government has formally linked APT29 to Russia’s Foreign Intelligence Service, the SVR, and said its chief task is intelligence gathering for Moscow. The operation used compromised legitimate websites to fingerprint thousands of mobile visitors and collect data from targets the attackers flagged as interesting.

Three infection vectors drove the campaign: malicious JavaScript injected into legitimate websites, lookalike domains acting as reverse proxies, and a supply-chain compromise of the Ukrainian analytics service Plerdy. Amaury-Jacques Garçon and Félix Aime wrote the technical report explaining how the injected JavaScript collects browser and device attributes. “The injected JavaScript code collects browser and device attributes,” the researchers wrote.

The initial JavaScript profiled each visitor’s device and browser before the command-and-control server served a platform-specific n-day exploit chain (a chain of known, already-patched vulnerabilities) that required no action from the user. A minified AngularJS library that accounted for 98 percent of a 2.3 MB file carried UltimateFingerprinter and ran 61 collectors to build 394 fields. The fingerprinting code gathered browser and device configuration data and transmitted it in JSON format before the server delivered the exploit. Researchers retrieved the exploit chains by testing browser profiles against the fingerprinting endpoint at static[.]flux-telemetry[.]com.

Safari cookies on iOS 16.7 were the target of Class A, which used CVE-2025-43529 and CVE-2024-27834. For iOS 16.7, the chain recreated DarkSword remote code execution to gain arbitrary read and write access. It then leveraged CVE-2024-27834 to get around Apple’s Pointer Authentication Codes so cookie-stealing code could run outside Safari.

Class B targeted iOS 18.5 through the DarkSword exploit chain built from CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. Data taken included SMS and iMessages, mail databases, voicemail, chat databases from WhatsApp and Telegram, and iCloud Keychain. Contacts, call history, Safari history and cookies, and photos were also taken. The chain also took Apple Health, Calendar, Notes, and iCloud Drive data.

The Android class went after Chrome versions 139 through 145, except version 143, with CVE-2026-3910 and CVE-2025-27038 to drop AndroSnitch. Before dropping the payload, the chain achieved remote code execution, sandbox escape, and privilege escalation. AndroSnitch collected Chrome cookies, saved logins, history, and Wi-Fi passwords. The AndroSnitch payload resembles ANDROSNATCH, a Chrome cookie stealer that Google documented in August 2024 during a suspected APT29 campaign against a Mongolian government website involving CVE-2024-5274 and CVE-2024-4671.

The payloads did not create persistence on infected devices. Rebooting halted the malicious activity until the person returned to a compromised site. Exploitation ended on Android if the chain spotted a Samsung Galaxy S25 Ultra carrying model identifier SM-S938B. The stolen information went to ad.starx-net[.]com:8881/telemetry/v12, and the iOS chains set a marker cookie meant to stop reinfection for a day, though a coding mistake caused it to expire after one minute.

Between August 27 and September 3, 2026, the intrusion set compromised the Ukrainian Plerdy analytics tracker hosted under the domain a.plerdy[.]com/public/js/click/main.js, leaving thousands of mostly Ukrainian sites and their visitors exposed. “Direct JavaScript injection on legitimate websites, Adversary-in-the-Middle-like domains, and the supply-chain compromise of the Ukrainian web analytics service,” Sekoia researchers said. Through Plerdy, the supply-chain spread reached high-value targets including army, special forces, and military equipment sites that cover ballistic and UAV systems. For the Bulgarian compromise, attackers changed an existing JavaScript library but left the website’s visible pages unchanged.

Sekoia considers it possible the operators moved to Plerdy because direct code injection into Ukrainian high-value sites that depended on it failed. Sekoia added that the Plerdy payload targeted a load-balancing domain directing traffic across several delivery servers. Lookalike domains included america250[.]holiday, which copied America250.org, and theowo[.]club, which served as a reverse proxy for Raffles London at The OWO close to UK government institutions. The lookalike sites pretended to be high-profile websites from the United States, Ukraine, the Czech Republic, and Bulgaria.

Sekoia cited open-source reporting indicating that Ukrainian President Volodymyr Zelensky stayed at Raffles London at The OWO during an October 14 visit.

Among the compromised legitimate sites were a Ukrainian gas producer and a US chemical-industry trade association. Attackers also hit a Bulgarian military-related organization, a Czech far-right movement, and a far-right European political party. The campaign concentrated victims in Ukraine and the United States, though it also affected European and American organizations, and most victims operated from Ukraine. Attackers also compromised an Australian medical clinic that seemed to have no strategic value, and Sekoia’s TDR team assessed with low confidence that these sites may have targeted specific individuals.

Sekoia said it remained unclear whether the attackers were after specific visitors or tried to infect as many unpatched mobile devices as possible before sorting later. Only implausible screen sizes like 99999 or devices that reported zero touchpoints blocked exploit delivery. Sekoia said it does not know why attackers gathered so much data and saw no sign anyone used it afterward.

Indicators tying the campaign to APT29 included remnants of a 2025 watering-hole operation attributed to the group. Sekoia also saw similarities to a 2024 APT29 campaign against Mongolian government websites that Google TAG confirmed, and Google TAG observed AndroSnatch, a Chrome cookie stealer resembling AndroSnitch, in Midnight Blizzard attacks between 2023 and 2024. A 2024 Google report on an earlier APT29 operation against Mongolian government websites described a hardcoded filter targeting specific sites. The 2026 campaign used no filter and collected any cookies in the browser.

APT29 links to the 2016 Democratic National Committee breach, the 2020 theft of COVID-19 vaccine research, and the SolarWinds supply-chain compromise that reached US government agencies and private organizations. APT29 has a reputation for stealthy, long-term intrusions. In recent years it has targeted cloud environments, e-mail accounts, and technology providers more often to reach downstream victims. Microsoft said APT29 spent months taking over hotel and conference center Wi-Fi networks, stealing Microsoft 365 credentials and delivering malware.

Sekoia assessed that APT29 probably got the exploits from a third party, possibly a commercial surveillance vendor. The group described DarkSword as suspected software from a commercial surveillance vendor, and DarkSword appeared on VirusTotal in September 2026. Google researchers tied DarkSword to customers of PARS Defense, a surveillance vendor in Turkey, and to at least two other groups. CVE-2025-43529 connects to DarkSword, which was first documented in March and used in attacks since at least November 2025 by multiple threat groups.

Vendors had patched every flaw used in the campaign before it started, so devices running updated operating systems were safe. “a user running an up-to-date operating system is safe from these attacks,” Sekoia said. CVE-2024-27834 was patched in May 2024, CVE-2026-3910 received a March zero-day patch, and CVE-2025-27038 was fixed with Android’s August 2025 security update; the CVE record says improved checks resolved the issue in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, and watchOS 10.5. CISA added CVE-2024-27834 to its KEV catalog on November 4, 2026, and directed US federal civilian agencies to patch affected devices by November 18, 2026.

Rescana researchers warned that KEV status means attackers are using the flaw in chains. They also cited the risk of suppliers handling data on old, unmanaged iPhones or Macs. Sekoia found four more vulnerabilities in unreachable code or alternate exploit paths, but none appeared in the analyzed chains. Sekoia warned that packaged n-day exploit chains lower the cost and technical threshold for advanced mobile exploitation and that reuse of commercial surveillance vendor exploits among state-sponsored groups will likely become more frequent.

“The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation,” Sekoia said, and the firm is working with CERTs from affected countries, including CERT-UA, to identify victims and disrupt the watering-hole infrastructure.