Sekoia links APT29 to mobile watering hole attacks

Sekoia researchers have traced a large-scale watering hole campaign they attribute, with moderate to high confidence, to Russia-linked APT29 (aka SVR group, Cozy Bear, Nobelium). The operation ran from late August to early September 2026 and targeted iOS and Android users by compromising a mix of hacked or cloned high‑profile websites in the United States, Ukraine, the Czech Republic and Bulgaria, as well as a Ukrainian web analytics service, Plerdy, loaded by thousands of sites.

The intrusion involved three delivery methods that all culminated in the same malicious payload: malicious JavaScript injected into hacked sites, fake replica sites with hidden malicious code, and a compromised Plerdy script delivering a malicious loader. Notably, a Bulgarian site saw an existing JavaScript library altered without changing the site’s visible pages.

Sekoia identifies three exploit chains delivered through the compromised infrastructure. Class A targets iOS 16.7 to steal cookies; Class B targets iOS 18.5 and exfiltrates full device data; Class C targets Android Chrome versions 139–145 (except 143) to harvest Chrome cookies and Wi‑Fi passwords. The Android payload is described as AndroSnitch; the iOS component is described as DarkSword, a suspected iOS exploit kit from a commercial surveillance vendor.

Stolen data is staged at ad[.]starx-net[.]com:8881/telemetry/v12, but none of the chains persist on the device and all rely on known, non‑zero‑day flaws. Attribution references CERTs and Google TAG, with indicators pointing toward APT29 while acknowledging uncertainty about targeting patterns. The report notes the operation reused commercial surveillance tooling and that updated devices remain protected.