APT29 Watering Hole Attacks Exploit Patched iOS and Android Flaws
November 5: Reports add details on DarkSword toolkit, spoofed sites America250 and Raffles London, and targets including Ukrainian gas producer and US chemical trade association.
Russian state-linked APT29 used watering hole attacks on hijacked sites and a compromised Ukrainian analytics service to deliver exploits for previously patched iOS and Android flaws.
Russian APT29 compromised the Plerdy analytics service late August to early September 2026, injecting malicious JavaScript to fingerprint devices on hundreds of legitimate sites in the US, Ukraine, Czech Republic and Bulgaria. The group also used spoofed domains including america250.holiday and Raffles London. Payloads stole cookies, Wi-Fi passwords and device data; on iOS 16.7 and 18.5 devices they deployed DarkSword to exfil messages, emails, passwords, contacts, photos and location history. All exploits targeted already-patched flaws in Chrome and iOS versions. No persistence was established and Sekoia has not determined the number of devices compromised.
- APT29 compromised Plerdy analytics service late August to early September 2026
- Injected fingerprinting JavaScript on hundreds of sites
- Exploited patched iOS 16.7, 18.5 and older Chrome versions
- Used DarkSword toolkit on iOS devices
- Spoofed sites included america250.holiday and Raffles London
- No persistence established; all flaws previously patched
Timeline
dated events in the reporting · oldest first- Aug 25, 2026Plerdy analytics service compromised · The Record
- Sep 5, 2026Plerdy tracking script reached hundreds of sites · Security Affairs
- Oct 15, 2026Campaign spotted in mid-October targeting US and Ukrainian sites · Security Affairs
- Nov 4, 2026Infosecurity Magazine reports APT29 campaign · Infosecurity Magazine
What each outlet adds
beyond the shared facts- The RecordDetails DarkSword toolkit, spoofed sites America250 and Raffles London, specific targets like Ukrainian gas producer
- Ars TechnicaDescribes america250.org impersonation via reverse proxy and UK government targets
- Security AffairsSpecifies Plerdy compromise late August to early September 2026 and fake sites for spear-phishing
- Dark ReadingLists APT29 aliases Cozy Bear, Midnight Blizzard, The Dukes and broader targets including tech and healthcare
- Infosecurity MagazineNotes three delivery routes and campaign targets in Ukrainian and US sites
- Threat actors
- APT29Russia’s Foreign Intelligence Service
- Malware
- DarkSword
Coverage
oldest first · one row per article · UTC- · 5d ago
Infosecurity MagazineFirst report
APT29 watering holes target patched iPhones and Android
Attackers served exploit chains for already-patched iOS and Android flaws via legitimate websites and lookalikes.
- · 4d ago
Ars Technica · Security
Kremlin-linked hackers exploit iOS and Android flaws to infect phones
Attackers injected JavaScript to profile devices and steal cookies, Wi-Fi passwords, and full device data from visitors to targeted sites including america250.org.
- · 4d ago
Security Affairs
APT29 uses watering hole attacks on mobile devices
Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.
- · 3d ago
The Record
APT29 ran zero-click smartphone espionage campaign against Ukraine, US and Europe
Sekoia says the SVR-linked group watered legitimate and spoofed websites and compromised Plerdy analytics to steal messages, passwords and photos from iPhones and Androids.
- · 3d ago
Dark Reading
APT29 uses watering holes to target mobile users
Russian state-sponsored APT29 compromised a Ukrainian SEO site to distribute fingerprinting code to potentially thousands of iPhone and Android users.