APT29 watering hole campaign targets thousands of mobile users

Russian state‑backed threat group APT29 has compromised a Ukrainian website analytics provider and briefly used that access to deliver device‑fingerprinting code to thousands of mobile users, potentially affecting iPhone and Android devices. Sekoia researchers say the weeklong compromise was part of a broader watering‑hole campaign that used legitimate and fake sites to spread fingerprinting malware and later exfiltrate personal data from selected devices. The campaign targeted users across Europe and the United States, with Ukraine‑based victims most prevalent.

Three infection vectors were used to reach iOS and Android devices. The first involved injecting malicious JavaScript into compromised legitimate sites, including a US chemical‑industry trade association, a Ukrainian gas producer, and a Bulgarian military‑related site. When legitimate sites could not be breached, attackers created lookalike domains, such as America250 and London’s Raffles hotel, injecting the malicious code in real time.

The third vector was a supply‑chain compromise of Ukrainian analytics firm Plerdy, which serves thousands of sites that embed its scripts. The fingerprinting collected device and browser data and sent it to APT29’s command‑and‑control; the attackers then delivered one of three exploit chains tailored to the victim’s platform and browser/OS version.

On iOS, exploits targeted vulnerabilities including CVE‑2025‑43529 and CVE‑2024‑27834 to steal browser cookies on iOS 16.7, while iOS 18.5 devices received the full DarkSword chain, capable of exfiltrating SMS/iMessages, voicemail, messaging data from WhatsApp and Telegram, stored passwords, tokens, credentials, call history, contacts, calendar entries, notes, photos and more.

Sekoia notes indicators linking this operation to APT29, including remnants of a 2025 watering‑hole campaign, and suggests possible use of a third‑party commercial surveillance vendor. The campaign underscores the growing appeal of mobile devices for intelligence gathering and the commoditisation of exploit chains.