Overview
Sekoia has published research on a large-scale watering hole campaign it attributes, with moderate to high confidence, to the Russia-linked threat actor APT29. The campaign targets iOS and Android users through compromised websites, lookalike domains, and a supply chain attack on Plerdy SEO Tracker, a Ukrainian web analytics service.
Delivery Methods
Sekoia observed three delivery routes:
- Scripts injected directly into legitimate websites
- Lookalike domains that proxy the real site while adding malicious scripts
- A compromise of the Plerdy tracker file,
a.plerdy[.]com/public/js/click/main.js
Between 27 August and 3 September 2026, the attackers altered the tracker file. Every site that loaded it during that window also loaded the attackers' script. Thousands of websites, mostly in Ukraine, were exposed.
Exploit Chains
The injected JavaScript fingerprints the browser and device, then the delivery infrastructure serves a platform-specific n-day exploit chain that needs no further user interaction:
| Target | Details |
|---|---|
| iOS 16.7 | Uses CVE-2025-43529 and CVE-2024-27834; steals cookies |
| iOS 18.5 | The DarkSword exploit kit, which leaked online earlier this year |
| Android (Chrome 139 to 145, excluding 143) | Steals browser cookies and Wi-Fi passwords; The Hacker News links the payload to a malware family called AndroSnitch |
Sekoia's analysis supports the idea that APT29 obtained the exploits from a third party rather than developing them. None of the payloads established persistence, and the campaign may have been aimed at specific individuals rather than a broad audience.
Attribution Basis
Sekoia points to traces of a 2025 APT29 watering hole operation on one compromised site, similarities to the 2024 APT29 campaign against Mongolian government websites, and a victim list centered on Ukraine. Sekoia is working with CERTs in affected countries, including CERT-UA, to identify victims and disrupt the infrastructure.
Recommendations
- Update iOS and Android devices and Chrome to current releases. These chains rely on already-patched flaws.
- Audit third-party scripts loaded on your sites. Use Subresource Integrity where the vendor allows it, and a strict Content Security Policy.
- Check web logs for requests to the Plerdy tracker between 27 August and 3 September 2026, and review sites that embedded it.
- Rotate sessions for high-risk users who browsed affected Ukrainian sites during that window, since the payloads steal cookies.
- Consider Lockdown Mode on iOS for at-risk individuals.
Sources
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits — The Hacker News
- Poisoned Source: APT29 watering holes target mobile devices with n-day exploits — Sekoia
- APT29 Watering Holes Target Unpatched iPhones and Android Devices — Infosecurity Magazine
- Russian hackers target iOS and Android users with n-day exploits — Help Net Security