APT29 uses watering hole attacks on mobile devices
Original title: Russian APT29 Targets Mobile Users with Watering Hole Attacks
Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.
The Russian APT29 group targeted mobile users through watering hole attacks on hijacked websites and a compromised Ukrainian analytics service called Plerdy. Attackers injected malicious JavaScript into high-profile sites in the US, Ukraine, Czech Republic, and Bulgaria, and created fake websites to impersonate legitimate services. The campaign compromised the Plerdy tracker between August and September 2026, leading to fingerprinting scripts that delivered exploit chains for iOS and Android.
Unconfirmed: Whether the fake websites were used for targeted spear-phishing of diplomatic delegations
- Campaign spotted in mid-October 2026
- Compromised Plerdy analytics service loaded by thousands of sites
- Targets iOS 16.7 and Android Chrome browsers
- Uses fake sites for potential spear-phishing
- Payload exfiltrates device data before selective exploitation
Impact: fingerprinting and remote code execution on iOS and Android
- 1.Avoid visiting hijacked sites
- 2.Update mobile devices
- 3.Disable JavaScript on suspicious pages
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | plerdy.com | 3, 2026, the attackers compromised the Plerdy tracker at a.plerdy[.]com. For a week, visitors loaded both Plerdy’s script and the |
| domain | starx-net.com | ake makes it expire in a minute. All stolen data goes to ad.starx-net[.]com:8881/telemetry/v12. None of the chains persist on the dev |
| domain | static.flux-telemetry.com | ent browser profiles against the fingerprinting endpoint at static[.]flux-telemetry[.]com in order to retrieve the exploits served to visitors.” |
| domain | theowo.club | inistry of Defence and Downing Street. “The second website, theowo[.]club , now offline, acted as a reverse proxy for the website o |
From the original article
6 min read at securityaffairs.com
Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service. Sekoia says a large-scale watering hole campaign is going after iOS and Android users, and it links the campaign to APT29 (aka SVR group, Cozy Bear, Nobelium, BlueBravo, Midnight Blizzard, and The Dukes), the Russian group tied to the SVR foreign intelligence service. A watering hole […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.