APT29 targets mobile devices in watering hole campaign

Sekoia uncovered a cyberespionage campaign in mid-October 2026 that it attributed, with moderate to high confidence, to Russia-linked APT29, also known as Midnight Blizzard and Cozy Bear, or one of its subgroups. The operation planted scripts on legitimate websites, used lookalike domains that proxied genuine sites, and exploited a week-long compromise of Ukrainian analytics tracker Plerdy.

The affected sites included Ukrainian energy, military and equipment websites, a US chemical-industry association, a Czech political movement and a Bulgarian military-related site. The lookalikes impersonated the America250 initiative and a London hotel.

The Plerdy compromise ran from 27 August to 3 September 2026. Because the tracker was used by thousands of mostly Ukrainian websites, Sekoia said hundreds of sites and their visitors were exposed; it did not report how many devices were compromised. Visitors were fingerprinted and served exploit chains suited to their devices, with no user interaction required. The payloads collected browser cookies, device data or Wi-Fi passwords and did not establish persistence.

The chains targeted iOS 16.7, iOS 18.5 and Chrome 139 to 145 on Android, excluding version 143. They exploited already-disclosed and patched flaws: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038. Sekoia said its analysis suggested APT29 obtained the exploits from a third party, and that devices running up-to-date operating systems were safe from these attacks.