Hackers tied to Russia's foreign intelligence service have been quietly booby-trapping websites in the US, Ukraine, the Czech Republic and Bulgaria so that simply visiting them on an out-of-date phone could hand over messages, passwords and photos. Researchers at Sekoia's Threat Detection & Research (TDR) team uncovered the campaign in mid-October 2026 and attribute it, with moderate to high confidence, to APT29, the intrusion set also tracked as Midnight Blizzard and Cozy Bear and widely linked to Russia's SVR.
The catch for the attackers is also the good news for defenders. Every exploit Sekoia recovered targets a flaw that was already patched before the campaign began. There are no zero-days here, and a fully updated iPhone or Android device is not vulnerable to these chains.
Three ways to poison a visit
A watering hole attack compromises sites a target is likely to visit, rather than attacking the target directly. Sekoia found APT29 using three routes to the same payload. First, it injected a small JavaScript snippet straight into legitimate websites, including a Ukrainian gas production company (where the investigation started), a major US chemical industry trade association, a far-right European political party and a Bulgarian military-related site, where the code was appended to an existing JavaScript library.
Second, where it could not break into a site, it built lookalike domains that act as reverse proxies, fetching the real page and inserting the malicious script on the fly. One, america250[.]holiday, mirrored the official site of America250, the US 250th anniversary initiative. Another, theowo[.]club, now offline, mirrored Raffles London at The OWO, a luxury hotel in the Old War Office building near the Ministry of Defence and Downing Street. Sekoia assesses both may have backed invitation-themed spear-phishing.
Third, and most broadly, the group compromised the Plerdy SEO tracker served from a.plerdy[.]com between 27 August and 3 September 2026. That script is loaded by thousands of websites, most of them Ukrainian, including army, special forces and military equipment sites, so for one week their visitors also pulled down APT29's code.
A fingerprint that barely matters
Every route loads a profiling script the operators named UltimateFingerprinter. It runs 61 collectors that build 394 fields describing the device, then posts them to a delivery server that answers with exploit code. Sekoia found almost none of it affects delivery; only an implausible screen size or a non-touch device blocks the exploits.
Phone-wide theft through patched bugs
By feeding the server different browser profiles, Sekoia retrieved three complete chains:
- Chain A (iOS 16.7): CVE-2025-43529 for initial code execution plus CVE-2024-27834 to bypass Apple's pointer authentication, ending in theft of app cookies.
- Chain B (iOS 18.5): the DarkSword kit, a suspected commercial surveillance vendor toolkit uploaded to VirusTotal in September 2026. It chains five bugs and then harvests SMS and iMessage, WhatsApp and Telegram databases, Keychain passwords, contacts, call history, location caches, Health data and photos.
- Chain C (Android Chrome 139 to 145, excluding 143): CVE-2026-3910 and CVE-2025-27038, stealing Chrome cookies and saved Wi-Fi passwords.
Sekoia saw no persistence on either platform. The data is taken in one pass and sent to infrastructure at ad.starx-net[.]com. DarkSword has surfaced on IntelFusions before, in a fake iPhone preorder page, and this is not APT29's first watering hole either: Amazon disrupted one that abused Microsoft device code sign-in.
Update the phone, then hunt the domains
The fix is unglamorous: keep iOS and Chrome on Android current, and enforce minimum OS versions through mobile device management for staff who travel or work with government, defence or energy. The CVEs used, by NVD score: CVE-2025-43529 (8.8), CVE-2025-14174 (8.8), CVE-2026-3910 (8.8), CVE-2026-20700 (7.8), CVE-2025-43510 (7.8), CVE-2025-27038 (7.5) and CVE-2025-43520 (5.5), all on CISA's Known Exploited Vulnerabilities catalog. No score is recorded in our data for CVE-2024-27834. Site owners using Plerdy should review what their pages loaded during the 27 August to 3 September window. Sekoia says it is coordinating with the CERTs of affected countries on victim identification.
Selected indicators (defanged):
- static.flux-telemetry[.]com (109[.]104[.]106[.]107)
- edge-ord.clouds-stacks[.]com
- ad.starx-net[.]com, including hxxps://ad.starx-net[.]com:8881/telemetry/v12
- america250[.]holiday (192[.]121[.]46[.]25), theowo[.]club (188[.]190[.]17[.]232)
- Fingerprinter filename: 5b4c8fea5cbcee273e8d830f52-temfp.js
- SHA-256 (Chain A): bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088
- SHA-256 (AndroSnitch, Android): 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c
The lesson is an old one with a sharper edge. A state service with access to a surveillance-grade toolkit chose to spend it on phones that simply had not been updated, and on the sites their owners read every day.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.