APT29 uses fake US UK sites for iOS Android exploits
Original title: Russian Hackers Create Fake US and UK Websites to Target Visitors With Mobile Exploits
APT29 campaign hits iOS 16.7 18.5 and Android Chrome with patched n-day flaws via JavaScript injection and supply-chain compromise.
Sekoia identified a watering hole campaign by APT29 using fake US and UK websites to deliver exploits to iOS and Android users. Attackers modified a Ukrainian SEO tracker and used cloned domains. All chains use patched n-day flaws.
- Targets iOS 16.7 with CVE-2025-43529 CVE-2024-27834
- Targets iOS 18.5 with DarkSword kit
- Targets Android Chrome 139-145 with CVE-2026-3910
- Delivers UltimateFingerprinter script
Impact: cookie theft and full device compromise
- 1.patch iOS and Chrome
- 2.block starx-net domain
- 3.review Plerdy tracker usage
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
| CVE-2025-14174 | Out of Bounds Memory Access in Google Chromium ANGLE Affects Chrome, Edge, Opera | 8.8 | 55% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
CVE-2025-43510+1 related CVE | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-43529 | Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution | 8.8 | 26% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adsprism-stat.com | static.flux-telemetry[.]com america250[.]holiday 19/05/2026 adsprism-stat[.]com Note: IP addresses and domains are intentionally defanged |
| domain | america250.holiday | was a set of adversary-in-the-middle-style reverse proxies. america250[.]holiday mirrors the America250 independence-anniversary site, and |
| domain | flux-telemetry.com | e Malicious delivery domain theowo[.]club 18/06/2026 static.flux-telemetry[.]com america250[.]holiday 19/05/2026 adsprism-stat[.]com Note: |
| domain | plerdy.com | etween 27 August and 3 September 2026, attackers modified a.plerdy[.]com’s tracker file so every visitor also loaded their fingerp |
| domain | starx-net.com | history and Wi-Fi configuration. All chains send data to ad.starx-net[.]com:8881/telemetry/v12 and establish no persistence. Google’s |
| domain | theowo.club | y mirrors the America250 independence-anniversary site, and theowo[.]club mirrored Raffles London at The OWO, a hotel near the Mini |
From the original article
3 min read at gbhackers.com
A large-scale watering hole campaign that it assesses, with moderate to high confidence, is the work of APT29. APT29 is also tracked as Midnight Blizzard, Cozy Bear and The Dukes, and is widely linked to Russia’s SVR foreign intelligence service. The operation hit iOS and Android users through compromised sites, cloned domains, and a poisoned […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.