Threat intel

APT29 poisoned an analytics script to hack phones

By Yaali. November 6, 2026, 6 min read, Threat intel, Mobile, Patching.

Sekoia ties a watering hole campaign to APT29: a hijacked Plerdy tracker and hacked sites served iOS and Android exploit chains. What to patch and check.

On November 4, Sekoia's threat research team published "Poisoned Source", a watering hole campaign it links to APT29, the Russian foreign intelligence (SVR) group also tracked as Midnight Blizzard and Cozy Bear, with moderate to high confidence. Between August 27 and September 3, 2026, the attackers modified the tracking script of Plerdy, a Ukrainian web analytics service loaded by thousands of mostly Ukrainian websites. Anyone who opened one of those sites on an out-of-date phone could be served an exploit chain that stole cookies, saved logins, messages and Wi-Fi passwords.

Plerdy was one of three delivery routes. The same profiling script also sat on hacked websites and on lookalike copies of real sites, and Sekoia found it only in mid-October. All eight vulnerabilities in the chains were already patched, so fully updated iPhones and Android phones were never in range. On November 4 the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog with a November 18 deadline for federal agencies; the other seven were already listed. The phones at risk are the ones running iOS 16 to 18 or Chrome 139 to 145, which in most fleets means personal devices and phones nobody has updated in months.

How the script hijack worked

Plerdy's customers paste one line into their pages that loads a.plerdy[.]com/public/js/click/main.js. For a week, that file carried the legitimate tracker plus a few extra lines. On window.onload the extra code created a new script element pointing at edge-ord.clouds-stacks[.]com, a domain registered on August 26. That host worked as a load balancer, redirecting each request to one of four delivery servers: ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com and assets-int[.]com.

The script that loaded, which the attackers call UltimateFingerprinter, is about 2.3 MB. Roughly 98% of it is a minified AngularJS library that never runs; Sekoia thinks the padding is there to look legitimate or to overflow the context window of AI tools used to triage scripts. The working part runs 61 collectors and posts 394 fields as JSON to the server, which decides whether to send exploit code back.

Only three fields stopped delivery: an implausible screen width or height (such as 99999) and navigator.maxTouchPoints equal to 0. A desktop or an emulator with no touch screen got an empty 200 response.

The hacked sites carried a similar loader in their page templates; on a Bulgarian military-related site the attackers tampered with an existing JavaScript library instead. The lookalike domains, america250[.]holiday and theowo[.]club, were reverse proxies of the US 250th anniversary site and the Raffles London at The OWO hotel site, rewriting each page on the fly to add the script. Sekoia suspects they were sent in invitation-themed spear-phishing, possibly at diplomatic delegations, but has not confirmed that.

The three exploit chains

Chain A was served to iOS 16.7. It pairs CVE-2025-43529, a use-after-free in WebKit, the engine behind Safari and every iOS browser, with CVE-2024-27834, a bypass of Pointer Authentication (PAC), the hardware check that stops attackers redirecting code. It reads the Cookies.binarycookies files in app containers. Sekoia notes the exploit works from iOS 16.0 to 17.4 while the server only filtered for 16.7, one reason it believes the exploits were bought from a commercial surveillance vendor rather than written by APT29.

Chain B targets iOS 18.5 and is the DarkSword kit. It runs in three stages: WebKit code execution and a PAC bypass (CVE-2025-43529, CVE-2026-20700), two sandbox escapes (CVE-2025-14174, CVE-2025-43510), then kernel read and write (CVE-2025-43520). The harvester takes messages, WhatsApp and Telegram databases, Keychain items, Wi-Fi keys, Health data, photos and iCloud Drive.

Chain C hits Chrome 139 to 145 on Android, except 143. CVE-2026-3910 in Chrome's V8 JavaScript engine gives code execution in the renderer, and CVE-2025-27038 in Qualcomm's Adreno GPU driver escapes Chrome's sandbox. The payload, which Sekoia named AndroSnitch, uploads Chrome's Cookies, Login Data and History files plus the Wi-Fi configuration to ad.starx-net[.]com:8881/telemetry/v12, the same endpoint the iOS chains use.

Who was exposed

Besides the Plerdy customers, which included army, special forces and military equipment sites, Sekoia lists a Ukrainian gas producer (where it first spotted the script), a US chemical industry association, a far-right European political party and a far-right Czech movement. The attribution rests on file overlaps with a 2025 APT29 watering hole shared by national CERTs, and on Google's Threat Analysis Group confirming that the framework resembles the APT29 campaign against Mongolian government sites in 2024, which also stole browser cookies. Sekoia has not published how many phones were actually exploited. DarkSword on Ukrainian sites is not new, as we covered in our earlier post on Ukraine's mobile threat report; the Plerdy compromise and the Android chain are.

What to do

1. Phones. Put iPhones and iPads on the current release: iOS 26.7.2 or 27.2, both out since October 26. Older devices need iOS 16.7.8 or 17.5 at the very least, but that only closes the PAC bypass in chain A.
2. Devices stuck on iOS 18. Apple's notes and NVD list the CVE-2026-20700 fix only for iOS 26.3, and Ostorlab says it is still unfixed on the 18.x line. Some advisories name 18.7.5 instead, so treat that as unresolved. iOS 18.7.3 fixes the other four chain B flaws, which breaks the chain, and the current 18.x build is 18.7.11.
3. Android. Require Chrome 146.0.7680.75 or later (check chrome://version). The Adreno fix comes from the phone maker; Qualcomm shipped it to manufacturers in June 2025, so any phone still on a 2025 security patch level deserves a closer look.
4. Enforce it. In Microsoft Intune, set Minimum OS version under Devices, Compliance, iOS/iPadOS, Device Properties, and a minimum security patch level in the Android Enterprise policy. For people likely to be targeted, turn on Lockdown Mode (Settings, Privacy and Security, Lockdown Mode), which blocks some complex web technologies in Safari. Sekoia does not say whether it stops these specific chains.
5. Hunt. Search proxy and DNS logs back to April 2026, when the oldest of the attackers' domains were registered, for the domains above, plus static.flux-telemetry[.]com and theowo[.]club. The file name 5b4c8fea5cbcee273e8d830f52-temfp.js and the cookie VDGH_TOKEN_REF are iOS markers. Sekoia shares its full indicator list, YARA rules and the victim site list with national CERTs under TLP:AMBER.
6. If a phone was exposed. Assume its data left the device. Sign it out of every session, rotate passwords saved in Chrome or iCloud Keychain, and change Wi-Fi keys it held.

If you run a website with third-party scripts

A Content Security Policy (CSP) is a header that tells the browser which hosts may serve scripts to your page. A script-src allowing only a.plerdy.com would have blocked the tag pointing at edge-ord.clouds-stacks[.]com, though the modified main.js itself would still have run. Subresource Integrity (SRI) pins a script to a hash, so the browser refuses a changed file; that works for analytics only if you self-host a pinned copy and review updates. Also diff your templates and hosted JavaScript files against a known-good copy: the gas producer had an extra tag in its main template, and the Bulgarian site had a library edited without any visible change to the page.

Our mobile penetration testing covers device and MDM configuration, and web penetration testing includes the third-party scripts your pages load. If you want either looked at after this campaign, open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits, Security Affairs, Ostorlab, The Hacker News, CISA Known Exploited Vulnerabilities catalog, Apple security releases, Apple: iOS 18.7.3 security content, NVD: CVE-2026-20700, NVD: CVE-2024-27834, NVD: CVE-2025-43520, SOC Prime on CVE-2026-3910, Security Affairs on Qualcomm's June 2025 Adreno fixes.