Sekoia links iOS and Android watering hole campaign to APT29

Sekoia’s Threat Detection & Research team assessed with moderate to high confidence that APT29, also known as Midnight Blizzard and Cozy Bear and tied to Russia’s Foreign Intelligence Service, operated a watering hole campaign against iPhone and Android users discovered in mid-October 2026.

Sekoia tracks the operation as Poisoned Source and assessed the group behind it as APT29, Midnight Blizzard, Cozy Bear. Western governments have long associated APT29 with Russia’s Foreign Intelligence Service, the SVR. The firm’s attribution rests on traces of an earlier APT29 watering hole operation found on one compromised site, parallels with a 2024 operation against Mongolian government portals confirmed by Google’s Threat Analysis Group, and a victim list centered on Ukraine. Overlaps in command-and-control infrastructure with earlier operations also support the assessment.

The campaign relied on three infection vectors: injection of malicious JavaScript into legitimate websites, adversary-in-the-middle-like lookalike domains, and supply-chain compromise of a Ukrainian web analytics service named Plerdy. All three vectors delivered the same JavaScript loader that profiled the visitor’s browser and device before the infrastructure served a platform-specific exploit chain without user interaction. Visitors needed only to open a compromised page; no click, link tap, or installation required. Amaury-Jacques Garçon and Félix Aime of Sekoia wrote that injected code gathers browser and device attributes before the delivery infrastructure sends a payload intended for iOS or Android, stating “Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android.”

The injected script named UltimateFingerprinter hid within an enlarged copy of the AngularJS library comprising about 98 percent of the 2.3 MB file and gathered 394 data fields from 61 checks. According to Sekoia, the script’s purpose was to thwart automated analysis or disguise the swollen AngularJS file as harmless. It primarily screens out unusual devices, for example ones with large screens or lacking touch capability.

Attackers compromised Plerdy, a Ukrainian web analytics service, and served malicious code through its tracking script for one week between 27 August and 3 September 2026. The Plerdy SEO Tracker supply-chain compromise injected malicious code into a.plerdy[.]com/public/js/click/main.js. The script operates on thousands of mostly Ukrainian websites, including ones operated by the army, special forces and military equipment manufacturers, exposing thousands of mostly Ukrainian websites and their visitors. Sekoia’s probe started after researchers found a malicious script on a Ukrainian gas production company’s website, with attackers having inserted several lines of JavaScript into the firm’s main page template to pull a script from a server they operated.

Attackers registered america250[.]holiday as a reverse proxy for america250.org, the website run by the nonpartisan organization marking 250 years of American independence. The site comprises lawmakers, business leaders, and at least one former Trump administration member. Sekoia researchers said the domain may have been deliberately selected due to its association with a high-profile national celebration, stating “may have deliberately selected this website due to its association with a high-profile national celebration.”

The domain theowo[.]club proxied Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street, the British prime minister’s office. Sekoia researchers believed the fake hotel domain may have targeted diplomatic delegations and prominent guests, citing open-source reporting that Ukrainian President Volodymyr Zelenskyy stayed there during an October 14 visit. Attackers also used lookalike domains imitating well-known sites from the United States, Ukraine, the Czech Republic, and Bulgaria.

The watering holes hit a Ukrainian gas production company, a U.S. chemical industry trade association, a far-right European political party, a Bulgarian military-related organization, and an Australian medical clinic. Among the compromised sites stood a major American chemical industry trade association that represents U.S. companies across the chemical sector. Sekoia noted several compromised sites likely drew high-value or strategically important visitors given the Russia-Ukraine war.

On iPhones running iOS 16.7, attackers chained CVE-2025-43529 and CVE-2024-27834 to steal browser cookies, enabling reuse of logged-in sessions such as webmail. Class A places a marker cookie to prevent the exploit from running a second time on the same device. Sekoia saw indications that a third party supplied the exploits, noting that the server checked for iOS 16.7 even though the exploit functioned on iOS 16.0 through 17.4.

On iPhones running iOS 18.5, attackers used the DarkSword exploit kit chaining CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to extract SMS, iMessage, WhatsApp and Telegram data, Keychain passwords, location data, health information and photos. Class B on iOS 18.5 also exfiltrated Apple Mail databases, voicemail, contacts, call history, Safari history, and Calendar, Notes, and iCloud Drive data. Sekoia says Class B’s DarkSword kit leaked online earlier in 2026.

Android devices running Chrome from version 139 to 145 but not 143 were hit through CVE-2026-3910 in Chrome and CVE-2025-27038 in the Adreno graphics driver, grabbing Chrome cookies, saved logins, browsing history and Wi-Fi passwords. Class C on Android achieved remote code execution, sandbox escape, and privilege escalation before delivering the AndroSnitch payload. The Android payload was named AndroSnitch, derived from ANDROSNATCH, a Chrome cookie stealer Google documented in August 2024 for a suspected APT29 watering hole on a Mongolian government site, and collected Chrome data and Wi-Fi passwords without establishing persistence. The Android chain aborted exploitation if the device model identifier matched Samsung Galaxy S25 Ultra (SM-S938B); researchers did not explain the exclusion.

None of the payloads installed anything that stayed on the device after the payload sent data out, and restarting an infected device cleared the payload from memory. Attackers routed all stolen data to ad.starx-net[.]com:8881/telemetry/v12. Sekoia says this lack of persistence fits quick intelligence gathering.

Sekoia concluded that state-sponsored intrusion sets reusing packaged commercial exploit frameworks such as DarkSword reduce the cost and technical barrier for advanced mobile exploitation, a trend likely to grow more common. Google researchers tied DarkSword, a commercial iOS exploit kit, to clients of Turkish surveillance vendor PARS Defense and to no fewer than two more threat actors. Google describes DarkSword as a full iOS chain used by several surveillance vendors and suspected state actors, and says iOS 26.3 patched it. Weeks earlier, iVerify and Report URI detailed DarkSword’s P7 variant spread by half-click attacks through ad-based infrastructure, including a World Cup-themed Instagram ad from ad-track[.]live.

Sekoia concluded that state-sponsored intrusion sets reuse commercial exploit frameworks such as DarkSword. Researchers at iVerify, Report URI and Zimperium tracked the spread of DarkSword and Coruna kits through criminal channels, with Zimperium counting 608 domains serving Coruna-family code as of October 2026. Coruna was initially developed by a nation-state actor for highly targeted operations, but a leak after disclosure made it widely accessible to multiple threat actors. The Coruna and DarkSword distribution footprint spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites using hidden iframes.

The DeadTag criminal campaign obtains expired domains that sit behind old analytics and advertising tags still loaded by thousands of websites. DeadTag checks who is visiting and serves nothing to search engines, security scanners, automated browsers, or anything resembling a bot. DeadTag’s script contacts the attacker’s server, which decides where to redirect each visitor. DeadTag iPhone paths serve the Coruna kit for iOS 13 through 17.2.1 and DarkSword P7 for iOS 18.4 through 18.7, and more than 660 expired and re-registered domains make up the DeadTag network.

Microsoft reported over the summer that APT29 spent months taking over hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and distribute malware. Amazon reported in 2025 that an APT29 watering hole campaign directed visitors to counterfeit Cloudflare verification pages. Google determined that the 2024 exploits corresponded to tools from commercial surveillance vendors NSO Group and Intellexa.

The 2024 Mongolian government watering hole leveraged a Chrome exploit chain built on CVE-2024-5274 together with CVE-2024-4671. The 2024 Mongolian government campaign also stole cookies. The 2024 Mongolian campaign targeted a fixed list of sites including webmail and Google, Microsoft, and LinkedIn logins. The 2024 Mongolian government campaign applied a hardcoded filter aimed at specific websites, but the 2026 campaign lacked such a filter and gathered every cookie in the browser.

A partner CERT connected leftover traces found on a compromised site to a private 2025 report about an APT29 watering hole operation. Cyber Press reported that the targeting suits Russian goals, centered on Ukraine and including the compromise of a far-right Czech political site. The campaign’s infrastructure spans several hosting providers, matching a pattern from previous APT29 operations.

It remained unclear whether attackers intended to aim at visitors to specific sites or to hit as many unpatched mobile devices as possible without distinction. Sekoia’s TDR team believes with low confidence that sites of no clear strategic value, such as an Australian medical clinic, may have targeted specific individuals. Targeting defense-adjacent and diplomatic venues suggests the campaign sought a small group of strategically valuable visitors instead of mass infection, Sekoia said.

Sekoia says the findings increase pressure on companies and government bodies whose employees browse using personal or unmanaged phones. Because the exploits need no interaction, conventional phishing awareness offers little protection, Sekoia said. Sekoia says this pattern complicates attribution and slows victim notification. Sekoia says patched vulnerabilities stay live weapons as long as many devices remain without updates.

All vulnerabilities in the three chains were patched before the campaign started, meaning anyone on an updated operating system was protected from these attacks. Apple released security updates covering both current and older supported iOS branches. Sekoia is quoted as saying “a user running an up-to-date operating system is safe from these attacks.”

The practical defense is keeping iOS and Chrome current because every flaw in the chain has a fix; where updates are not possible, Google recommends Lockdown Mode on iPhones. Sekoia’s defensive advice includes replacing phones that no longer receive updates.

Security teams should check logs for malicious domains and review who has loaded third-party scripts. Enterprises should use mobile device management to stop outdated mobile operating systems from reaching corporate services and Microsoft 365 environments. Web administrators should audit third-party scripts and enforce Subresource Integrity to detect unauthorized changes to analytics or tracking libraries.

Static.flux-telemetry[.]com at 109.104.106[.]107, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com at 195.58.140[.]105 and cookie marker VDGH_TOKEN_REF all appeared in the indicator set. Sekoia passes indicators on to national CERTs and law enforcement agencies.

The firm said it worked with the CERTs of affected countries, including CERT-UA, to find victims and seek ways to disrupt the watering hole infrastructure. Sekoia did not disclose how many devices attackers compromised.