What happened
Sekoia found a large watering hole campaign in mid-October 2026 that it links, with moderate to high confidence, to Russia's APT29 (also Midnight Blizzard, Cozy Bear, tied to the SVR).
Visiting a poisoned page is enough. There is no click to make, no file to open. The page loads JavaScript that profiles your device, and the attacker's server sends back an exploit chain matched to your phone and browser.
The attackers used three routes to reach victims, all leading to the same profiling script:
- Direct JavaScript injection into hacked sites: a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related site.
- Lookalike reverse-proxy domains, theowo[.]club and america250[.]holiday, which relayed the real content of Raffles London at The OWO (a hotel near the UK Ministry of Defence and 10 Downing Street) and the America250 site, while injecting code. Sekoia notes open-source reporting that Zelensky stayed at the hotel on 14 October.
- A supply-chain compromise of Plerdy, a Ukrainian web analytics service loaded by thousands of sites. Between 27 August and 3 September 2026 the attackers altered its tracker file, so every site loading it also loaded their script.
The profiling script, UltimateFingerprinter, hides inside a minified AngularJS copy that makes up about 98 percent of a 2.3 MB file. It runs 61 collectors building 394 data fields, but mostly blocks only odd devices.
Timeline
- 27 Aug to 3 Sep 2026: Plerdy tracker serves the injection.
- 14 Oct 2026: Zelensky reportedly stays at the cloned hotel.
- mid-Oct 2026: Sekoia spots the campaign.
- 4 Nov 2026: CISA adds CVE-2024-27834 to its KEV catalog, with a two-week fix deadline for federal agencies.
Am I affected?
The exploits only hit outdated phones. Sekoia stresses that a device running an up-to-date OS is safe from these attacks.
- iOS Class A targets iOS 16.7 and steals Safari cookies, using CVE-2025-43529 and CVE-2024-27834.
- iOS Class B (the DarkSword kit) targets iOS 18.5 and takes almost everything: messages, WhatsApp and Telegram databases, Keychain passwords, contacts, location, photos and iCloud Drive. It chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520.
- Android Class C targets Chrome versions 139 to 145, except 143, using CVE-2026-3910 (Chrome) and CVE-2025-27038 (Qualcomm Adreno driver). The AndroSnitch payload takes Chrome cookies, logins, history and Wi-Fi passwords.
All stolen data goes to ad.starx-net[.]com. No payload persists, so a reboot stops the running activity, but anything already exfiltrated is gone.
What to do now
- Update every iPhone to the latest iOS and every Android to the latest Chrome. Apple and Google have patched all the flaws used here, with fixes backported to older iOS releases.
- Replace phones that no longer receive updates.
- Treat stolen cookies as live. Rotate credentials and force re-authentication for webmail and other sessions on any device that may have been exposed, especially for diplomats, military and defence staff.
- Block the IoC domains and IPs at your DNS and proxy: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, theowo[.]club, america250[.]holiday, adsprism-stat[.]com.
- Review who loads third-party scripts on sites you run, and confirm your Plerdy tracker and other analytics files have not been altered.
How to hunt
- Search proxy, DNS and SIEM logs for the delivery and exfiltration domains and IPs above (195.58.140[.]105 on port 8881, path /telemetry/v12).
- Look for connections to the listed Shock Hosting (AS395092) and servinga (AS219399) infrastructure.
- Match the SHA-256 hashes for the Class A, B and C stages and AndroSnitch against mobile forensic captures in VirusTotal or MISP.
- Check for traffic from military, defence or diplomatic users to any Plerdy-loaded site during 27 August to 3 September 2026.
What does not help
- A reboot alone. It ends the session but does not undo stolen data or invalidate cookies.
- Assuming you are safe because nothing was installed. These chains do not persist by design; the theft is the point.
Sources
- Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users, Cyber Security News, 4 Nov
- Russian APT29 Targets Mobile Users with Watering Hole Attacks, Security Affairs, 5 Nov
- Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes, SecurityWeek, 5 Nov
- Hackers use n-day exploits in zero-click attacks on iOS, Android devices, BleepingComputer, 4 Nov
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits, The Hacker News, 4 Nov
- Russian hackers target iOS and Android users with n-day exploits, Help Net Security, 4 Nov
