NEWS

APT29's Watering Holes Target Thousands of Mobile Users

Sekoia links a campaign abusing the Plerdy analytics script and lookalike sites to APT29, fingerprinting visitors and serving iOS and Android exploit chains.

Dylan H.

Security Team

November 5, 2026
3 min read
APT29's Watering Holes Target Thousands of Mobile Users

Overview

Sekoia's Threat Detection and Research team has reported a campaign, dubbed "Poisoned Source", that it assesses with moderate to high confidence is the work of APT29 (Cozy Bear, Midnight Blizzard), the Russian state-sponsored group. The operation was spotted in mid-October 2026 and reported on November 4. It fingerprints visitors to compromised and spoofed websites, then delivers mobile exploit chains only to devices that look like real phones.

Three Infection Vectors

  1. Compromised legitimate websites. Injected sites included a Ukrainian gas production company, a major U.S. chemical trade association, a far-right Czech political party and a Bulgarian military website.
  2. Adversary-in-the-middle style lookalike domains. Examples include america250.holiday and theowo.club, a proxy that mirrored the Raffles London at The OWO website.
  3. Supply-chain compromise of Plerdy, a Ukrainian analytics service. Dark Reading reports the compromise lasted about a week and potentially exposed thousands of iPhone and Android users.

Fingerprinting

All three vectors load a script called UltimateFingerprinter, hidden behind roughly 2.3 MB of dead AngularJS code. It gathers 394 fields through 61 collectors and posts them to a server. The server returns an exploit only if basic checks pass, such as a plausible phone screen size and a non-zero touch-point count, which helps keep researchers and desktop visitors from seeing the payloads.

Exploit Chains and Payloads

  • iOS: the chain leads to the DarkSword exploit kit, which harvests cookies and full device data.
  • Android: targets Chrome 139 to 145 (excluding 143) using CVE-2026-3910 and CVE-2025-27038, and delivers AndroSnitch, which steals Chrome cookies, saved logins, history and Wi-Fi settings. It resembles ANDROSNATCH, a Chrome cookie stealer Google documented in August 2024 in a suspected APT29 watering hole campaign.
  • All exploits target n-day flaws that already have patches. CISA added the iOS pointer-authentication bypass CVE-2024-27834 to its KEV catalog on November 4, with a federal deadline of November 18, 2026.
  • iOS 18.7.3 fixes every flaw in the iOS chain except CVE-2026-20700, which Apple had not fixed on the 18.x line as of November 5.

Targeting Is Unclear

Sekoia says it is unclear whether the operators intended to hit visitors of specific sites. They may instead have tried to compromise as many unpatched devices as possible and then selected data of interest.

Recommendations

  • Update iOS and Chrome on Android now. The whole campaign depends on unpatched devices.
  • Consider Lockdown Mode on iOS for high-risk users such as government, defense, energy and policy staff.
  • Audit third-party scripts loaded by your sites. Use Subresource Integrity where possible and a restrictive Content Security Policy to limit what injected analytics code can do.
  • Hunt for indicators from Sekoia's report, including connections to the listed lookalike domains, and review web proxy logs for Plerdy script loads during the compromise window.
  • Rotate sessions and credentials for users of potentially affected mobile devices, since the payloads steal cookies and saved logins.

Sources