APT29 watering hole campaign targets mobile users with exploits

In mid-October 2026, Sekoia Threat Detection and Research disclosed a significant APT29 watering hole operation targeting mobile devices across Europe and the United States. The attackers compromised a range of websites and hijacked the Ukrainian web analytics service Plerdy to profile visitors. Three infection pathways were used: direct JavaScript injections on legitimate sites, adversary‑in‑the‑middle style domains, and a supply‑chain compromise of Plerdy.

The campaign also involved deceptive reverse proxies (for example, lookalike domains such as america250[.]holiday and theowo[.]club) to lure visitors. Sekoia noted that the Plerdy compromise, running between 27 August and 3 September 2026, broadened the reach by exposing thousands of sites to malicious code that targeted strategic users including Ukrainian military units, special forces personnel and drone manufacturers.

The attacker’s profiling mechanism, named UltimateFingerprinter, ported as a malicious JavaScript payload into a minified AngularJS library (a 2.3 MB file, with 98% dead code) and collected 394 system attributes via 61 collectors before transmitting results to static.flux-telemetry[.]com. The server then verified only screen dimensions and touch capability to decide whether to deliver exploits; desktop visitors were typically served nothing.

When a mobile profile was matched, one of three platform‑specific exploit chains was served, all built on patched n‑day vulnerabilities rather than zero‑days. The Class A chain targeted iOS 16.7 and exploited CVE-2025-43529 for remote code execution and CVE-2024-27834 to bypass Pointer Authentication Codes, allowing extraction of Safari and other app cookies.

The Class B chain, attributed to a commercial surveillance kit creator, targeted iOS 18.5 through a multi‑stage sequence exploiting CVE-2025-43529 and CVE-2026-20700 for code execution, then CVE-2025-14174 and CVE-2025-43510 to break out of the browser sandbox, and CVE-2025-43520 for kernel read/write. It then gathered SMS, iMessage databases, WhatsApp chats, Telegram records, Keychain credentials, photos and location history.

The Class C chain targeted Android devices running Chrome 139–145 (excluding 143), exploiting CVE-2026-3910 for browser execution and CVE-2025-27038 in the Qualcomm Adreno GPU driver to escape the sandbox; the code aborts if it detects a Samsung Galaxy S25 Ultra. Post‑exploitation, AndroSnitch was used to exfiltrate Chrome login data, cookies, history and saved Wi‑Fi passwords.

Attribution rests with Sekoia, which links the activity to Russian state actors, known as Midnight Blizzard/Cozy Bear/The Dukes, suspected of acting for SVR. The researchers emphasise the campaign’s scale via the Plerdy compromise and its lower barrier to mobile exploitation through packaged n‑day chains. The report notes that updates to iOS and Android reduce risk and urges scrutiny of third‑party scripts and robust CSP/SRI implementations to mitigate supply‑chain risk. The piece is attributed to Do Son of SecurityOnline[.]info and cites Sekoia and Google TAG for corroboration.