APT29 watering hole campaign serves n-day iOS and Android exploits via hacked sites and Plerdy

What happened

Sekoia found a watering hole campaign in mid-October 2026 and assessed with moderate to high confidence that it is the work of APT29, also tracked as Midnight Blizzard and Cozy Bear, a group widely linked to Russia’s SVR (Infosecurity Magazine, Help Net Security). Sekoia codenamed the activity Poisoned Source (The Hacker News).

The campaign used three delivery routes:

• Injected JavaScript on legitimate sites. Victims included a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related site (Cyber Security News, Help Net Security).
• Lookalike reverse-proxy domains. america250[.]holiday mirrored the America250 site, and theowo[.]club mirrored Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street. Sekoia suspects these targeted diplomats and prominent guests (GBHackers).
• A supply-chain compromise of Plerdy SEO Tracker, a Ukrainian analytics service. Between 27 August and 3 September 2026, the tracker file was altered so every site loading it also loaded the attackers’ script (The Hacker News). Sekoia said the week-long compromise exposed hundreds of sites and their visitors, and the list included military and defense sites (Infosecurity Magazine).

All three routes load a fingerprinting script called UltimateFingerprinter, hidden inside a large AngularJS file of about 2.3 MB. It collects 394 fields from 61 checks, and the server returns an exploit only if basic checks pass, such as a plausible phone screen size and touch support (Cyber Security News, GBHackers).

Sekoia recovered three exploit chains. All use n-day flaws that were already patched, and none set up persistence:

• Class A: iOS 16.7, using CVE-2025-43529 and CVE-2024-27834 to steal cookies.
• Class B: iOS 18.5, using the DarkSword exploit kit with CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. It takes messages, WhatsApp and Telegram databases, Keychain data, contacts, call history, photos and iCloud Drive files.
• Class C: Android phones running Chrome 139 to 145, except 143, using CVE-2026-3910 and CVE-2025-27038, an Adreno GPU driver flaw. The payload, AndroSnitch, copies Chrome cookies, saved logins, history and Wi-Fi settings, and stops on a Samsung Galaxy S25 Ultra (model SM-S938B).

(The Hacker News, Cyber Security News)

Stolen data goes to ad.starx-net[.]com:8881/telemetry/v12 (GBHackers). Stolen cookies could let attackers reuse logged-in sessions, including webmail (Help Net Security).

Sekoia is working with the CERTs of affected countries to identify victims and try to disrupt the infrastructure. How many devices were compromised is not confirmed (Infosecurity Magazine). Sekoia also says the exploits likely came from a third party, and expects reuse of commercial surveillance exploit kits by state groups to grow (Cyber Security News).

Am I affected?

You are most at risk if you have a phone that is not fully up to date. Sekoia’s own words: “a user running an up-to-date operating system is safe from these attacks” (Infosecurity Magazine).

• iPhones on iOS 16.7 or iOS 18.5 match the targeted versions. Sekoia notes the Class A exploit works on iOS 16.0 to 17.4 even though the server checks for 16.7 (Cyber Security News).
• Android phones running Chrome 139 to 145 (not 143) match Class C. Why 143 is excluded is unknown (The Hacker News).
• Anyone who visited the named sites or lookalike domains, or any site that loads the Plerdy tracker, especially from 27 August to 3 September 2026, may have loaded the script. The Plerdy window is the only confirmed compromise period. Dates for the other injections are not confirmed.
• Site owners and network teams should check whether pages load the Plerdy tracker or other third-party scripts (Cyber Security News).

Exact fixed Chrome versions and the iOS versions that fix Class A are not confirmed in the sources. Apple patched the DarkSword flaws by iOS 26.3 (GBHackers).

What to do now

1. Update iOS and Chrome on all managed and personal phones that access work data.
2. Replace phones that no longer receive updates. Google also recommends Lockdown Mode where updates are impossible (GBHackers).
3. Search DNS, proxy and firewall logs for these indicators: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, theowo[.]club, america250[.]holiday, adsprism-stat[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com. Sekoia’s file hashes are listed in Cyber Security News. Re-fang indicators only inside controlled tooling.
4. Review which third-party scripts your sites load, and check for use of the Plerdy tracker, particularly a.plerdy[.]com/public/js/click/main.js (The Hacker News).
5. If a vulnerable phone visited an affected site, treat browser cookies and saved credentials as possibly stolen. Revoke active sessions, especially webmail, and rotate passwords and Wi-Fi credentials. This step is our inference from the reported data theft, not a vendor instruction.
6. Watch for updates from Sekoia and national CERTs, since victim identification and infrastructure disruption are still under way.

Sources

• Cyber Security News: Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users
• GBHackers: Russian Hackers Create Fake US and UK Websites to Target Visitors With Mobile Exploits
• Infosecurity Magazine: APT29 Watering Holes Target Unpatched iPhones and Android Devices
• The Hacker News: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
• Help Net Security: Russian hackers target iOS and Android users with n-day exploits