Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

APT29 linked to mobile watering hole campaign using exploits

Part of the CVE-2025-43529 story · since 12 Feb

Developinglatest 48 minutes ago9 articles6 outlets
12 Feb · SecurityOnline first24 Jun8 Aug22 SepNowThis article9th of 9
  • Thu 12 Feb, 04:01 UTC. SecurityOnline, first report. Apple Zero-Day (CVE-2026-20700) Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 07:25 UTC. The Hacker News, its first report on the story. Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 08:01 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 11:25 UTC. Security Affairs, its first report on the story. Apple fixed first actively exploited zero-day in 2026. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 12:25 UTC. Malwarebytes, its first report on the story. Apple patches zero-day flaw that could let attackers take control of devices. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 09:59 UTC. The Hacker News. DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 15:04 UTC. Security Affairs. DarkSword emerges as powerful iOS exploit tool in global attacks. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 14:30 UTC. Infosecurity, its first report on the story. APT29 targets mobile devices in watering hole campaign. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:30 UTC. The Hacker News. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV. This article, 9th of 9.

The Hacker News reports that the Russia-linked actor known as APT29 is linked to a large watering hole operation aimed at iOS and Android users, using compromised websites, lookalike domains and a supply chain compromise of the Ukrainian web analytics service Plerdy SEO Tracker. Sekoia researchers Amaury-Jacques Garçon and Félix Aime described the operation, codenamed Poisoned Source, as injecting JavaScript that profiles visitors and then delivers a platform-specific N-day exploit chain for either iOS or Android.

The end goal is to exfiltrate cookies, with potential access to Wi‑Fi passwords and broader device data, according to the technical briefing shared with The Hacker News.

Three infection vectors are used: compromising legitimate sites to inject malicious code, deploying lookalike sites impersonating high‑profile targets, and compromising Plerdy between 27 August and 3 September 2026 to inject code into a.plerdy[.]com/public/js/click/main.js. Among compromised sites are a major US chemical industry trade association, a European far‑right party and a Bulgarian military site, suggesting targeted rather than broad dissemination.

The campaign culminates in a JavaScript loader that evaluates the visitor’s device and browser and then routes to an exploit chain: Class A targets iOS 16.7 with CVE-2025-43529 and CVE-2024-27834 for cookie theft; Class B targets iOS 18.5 with a DarkSword‑derived chain including CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 for extensive iOS

data exfiltration; Class C targets Android Chrome 139–145 (excluding 143) exploiting CVE-2026-3910 and CVE-2025-27038 to deliver AndroSnitch for Chrome data and Wi‑Fi passwords. Exfiltrated data is sent to ad[.]starx-net[.]com:8881/telemetry/v12, with a device check that terminates activity on Samsung Galaxy S25 Ultra (model SM-S938B). The report notes continued reuse of mobile exploit frameworks like DarkSword by state‑sponsored groups, and highlights DeadTag and Coruna as mechanisms driving these campaigns.

How the story developed

All 9 articles
Developinglatest 48 minutes ago9 articles6 outlets

9 articles from 6 outlets since 12 Feb. Picked up again today after 33 weeks quiet. This was the 9th report, 265 days after the first.

Now12 Feb17212525811141721First reportSecurityOnline · 12 Feb, 04:01This article9th of 9 · day 265
  • Thu 12 Feb, 04:01 UTC. SecurityOnline, first report. Apple Zero-Day (CVE-2026-20700) Exploited in the Wild. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 07:25 UTC. The Hacker News, its first report on the story. Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 08:01 UTC. SecurityWeek, its first report on the story. Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 11:25 UTC. Security Affairs, its first report on the story. Apple fixed first actively exploited zero-day in 2026. Cites a CVE in CISA KEV.
  • Thu 12 Feb, 12:25 UTC. Malwarebytes, its first report on the story. Apple patches zero-day flaw that could let attackers take control of devices. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 09:59 UTC. The Hacker News. DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover. Cites a CVE in CISA KEV.
  • Thu 19 Mar, 15:04 UTC. Security Affairs. DarkSword emerges as powerful iOS exploit tool in global attacks. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 14:30 UTC. Infosecurity, its first report on the story. APT29 targets mobile devices in watering hole campaign. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:30 UTC. The Hacker News. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV. This article, 9th of 9.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Thu 12 FebDay 05
    1. Apple Zero-Day (CVE-2026-20700) Exploited in the Wild04:01 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices07:25 · The Hacker News · Known exploited CVE
    3. Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’08:01 · SecurityWeek · Known exploited CVE
    Show 2 more from 12 Feb
    1. Apple fixed first actively exploited zero-day in 202611:25 · Security Affairs · Known exploited CVE
    2. Apple patches zero-day flaw that could let attackers take control of devices12:25 · Malwarebytes · Known exploited CVE

  2. Quiet for 5 weeks

    Thu 19 MarDay 352
    1. DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover09:59 · The Hacker News · Picked up again · Known exploited CVE
    2. DarkSword emerges as powerful iOS exploit tool in global attacks15:04 · Security Affairs · Known exploited CVE

  3. Quiet for 33 weeks

    Wed 4 NovDay 2652
    1. APT29 targets mobile devices in watering hole campaign14:30 · Infosecurity · Picked up again · Known exploited CVE
    2. APT29 linked to mobile watering hole campaign using exploits15:30 · The Hacker News · Known exploited CVE · This article, 9th of 9

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in