Russia-linked threat actor APT29 used compromised websites, fake domains and a hijacked Ukrainian analytics service to deliver exploit chains against iOS and Android users, according to researchers at Sekoia. The campaign compromised Plerdy’s SEO Tracker between Aug. 27 and Sept. 3, 2026, turning a widely distributed web dependency into a supply-chain delivery mechanism.
The injected JavaScript fingerprinted visitors by collecting browser and device attributes before routing eligible targets to platform-specific infrastructure. The approach required little or no additional interaction from a victim who visited an affected site, making the operation a watering-hole attack rather than a conventional phishing campaign. Sekoia attributed the activity to APT29, also tracked as Cozy Bear and Midnight Blizzard, with moderate to high confidence.
On iOS 16.7 devices, the operators chained CVE-2025-43529, a JavaScriptCore memory-safety flaw, with CVE-2024-27834 to deploy JavaScript capable of stealing browser cookies. Recovered cookies can allow attackers to reuse authenticated sessions, potentially bypassing passwords and multifactor prompts until those sessions are revoked. Apple lists CVE-2025-43529 as fixed in iOS 18.7.3 and iOS 26.2, as well as corresponding Safari and iPadOS releases.
A second iOS path targeted version 18.5 and used the DarkSword exploit chain, including CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Research from Google Threat Intelligence says the chain could progress from browser compromise to broader device access, exposing messages, application databases, Keychain credentials, location information and photos. Apple has issued fixes across later iOS 18 and iOS 26 releases, including iOS 26.3 for CVE-2026-20700.
Android users running Chrome 139 through 145, excluding version 143, were targeted with CVE-2026-3910 and CVE-2025-27038. NVD describes CVE-2026-3910 as a Chrome V8 issue that could enable arbitrary code execution inside the sandbox through crafted HTML; Google fixed it before Chrome 146.0.7680.75. The resulting AndroSnitch payload was designed to collect Chrome data, saved credentials, browsing history and Wi-Fi passwords. Organizations should update managed browsers and mobile operating systems, revoke potentially exposed web sessions, and review traffic to Plerdy-dependent sites; the campaign relied on known, patched vulnerabilities, so timely updates remain the most direct defense.