APT29-Linked Mobile Watering Holes: Plerdy Compromise and iOS/Android Exploit Chains

1. Basic Information

• Article Title: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits
• Publisher: Sekoia
• Publication Date: 2026-11-04
• Collection Date: 2026-11-05T08:02:41+09:00
• Source: Sekoia
• Related Sources: BleepingComputer: campaign coverage
• Related Malware: DarkSword, AndroSnitch
• Related Threat Group: APT29 or a subgroup (Sekoia assessment: moderate to high confidence)
• CVEs: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038
• Targeted Products / Services: iOS 16.7, iOS 18.5, Android Chrome 139–145 excluding 143, Plerdy SEO Tracker
• Severity: Critical
• Severity Rationale: Malicious mobile exploit chains were delivered through legitimate sites and the Plerdy analytics supply chain. After a targeted device visits an affected site, exploitation requires no further user interaction. Payload analysis identified collection and exfiltration capabilities for sensitive data, including cookies, credentials, messages, locations, photos, and Keychain contents. Successful theft on individual victim devices and victim counts have not been disclosed.

2. Executive Summary

Sekoia identified a mobile watering-hole campaign delivering known vulnerability chains to unpatched iOS and Android devices through three routes: modified legitimate sites, lookalike domains, and compromise of the Ukrainian analytics service Plerdy. Payloads target cookies and other sensitive data. Sekoia assesses links to APT29 or a subgroup with moderate to high confidence; collection capabilities do not establish successful theft on every visitor's device.

3. Attack Flow

Platform-Specific Chains and Collection Capabilities

Delivery Sequence

1. Attackers inject malicious JavaScript into legitimate sites, lookalike sites, or Plerdy tracker scripts.
2. When a visitor browses an affected site, JavaScript fingerprints the browser and device.
3. If delivery criteria match the OS and browser, the infrastructure supplies the corresponding n-day chain without further user interaction.
4. Depending on the chain, exploitation combines renderer RCE, PAC bypass, sandbox escape, and privilege escalation. The chains do not all reach the same stages.
5. Final payloads such as DarkSword and AndroSnitch contain functions to collect and send the data listed for their respective chains to attacker-controlled infrastructure. These are analyzed capabilities, not confirmation of completed theft on every targeted device.

4. Attacker Position and Execution Location

• Attackers control web supply chains and legitimate or fake sites to deliver exploits over the internet to mobile visitors.

5. Visibility for Victims and Administrators

Victims

• Exploitation may occur after browsing an affected legitimate site, without further interaction. The analyzed chains do not establish persistence, so clear symptoms may be absent.

Administrators

• Potential investigation leads include third-party script changes, fingerprinting or delivery domains, browser crashes, possible exfiltration, and suspicious session reuse. These leads are not all confirmed observations on individual victim devices.

6. Success and Failure Conditions

Success Conditions

• A targeted unpatched iOS device, or an Android device with the targeted Chrome version and a vulnerable Qualcomm Adreno driver, visits an affected site. The Android chain stops on Samsung Galaxy S25 Ultra model SM-S938B; Chrome version alone is insufficient to establish exploitability.
• The device meets delivery-server criteria and can reach both the exploit infrastructure and the exfiltration endpoint.

Failure Conditions and Mitigations

7. What Happens Upon Success

• Browser cookies and saved login data can be stolen, depending on the chain.
• The iOS 18.5 Class B payload can collect messages, mail, Keychain contents, Wi-Fi data, location, health data, photos, and iCloud Drive data. The iOS 16.7 Class A chain is limited to cookie collection in this analysis.
• The Android chain targets Chrome data and saved Wi-Fi passwords.

These are potential outcomes of successful execution, not published counts of completed theft on victim devices.

8. Observable Logs

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

• Email: No incident-specific email entry vector has been disclosed.
• Proxy / SWG / DNS: Check traffic from affected sites to fingerprinting or delivery infrastructure such as flux-telemetry, and outbound connections to destinations such as ad.starx-net.com:8881.
• Endpoint / EDR: Where supported, review mobile security telemetry for browser crashes, privilege-escalation attempts, and abnormal access to protected device data.
• Identity / IdP: Investigate suspicious access from new IPs or User-Agents that might reflect reuse of already authenticated sessions. Such reuse has not been confirmed for individual victims in the published analysis.
• SaaS / Cloud: Review website-template changes, Plerdy or other third-party tag modifications, and CSP violation reports.
• Network: Look for unusual uploads from mobile devices to attacker infrastructure and traffic to unusual ports such as 8881.

9. Attack Success Determination

• Attack Attempts Observed (Success Unconfirmed): Public information: Sekoia observed malicious scripts and exploit-delivery infrastructure and retrieved three chains and their final payloads by varying browser profiles. Analysis confirmed collection and exfiltration functions. It did not establish execution or completed theft on individual victim devices, and victim counts were not disclosed. (Scope: Infrastructure and payloads observed or retrieved by Sekoia.)

Separate site contact, exploit delivery, execution, data collection, and session reuse. Evidence of one stage does not establish later stages.

10. Investigation Playbook

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Trigger

• Visits to related watering holes, suspicious delivery-domain DNS queries, mobile browser crash alerts, or suspected session reuse.

Initial Verification

• Check device OS and browser versions, patch levels, visited sites, Plerdy tags, and matching network IOCs.

Endpoints

• Preserve available mobile telemetry, browser crash dumps, and network records.

Authentication and Cloud

• For potentially affected cloud services, revoke exposed sessions or cookies using the service's supported controls and change affected passwords. Confirm revocation separately for each service, including mail, cloud services, and VPN access.

Subsequent Operations

• Investigate possible cookie reuse for webmail, cloud-storage downloads, or access through VPNs. These are investigation questions, not confirmed follow-on actions.

Containment

• Block related C2 domains, remove unauthorized external tags from owned sites, and update affected mobile operating systems or reset devices as appropriate.

Decision Categories

• Assess site visits, exploit delivery, code execution, exfiltration, and session reuse separately.

11. Defense and Detection Ideas

Inference: The following are investigation and detection suggestions for an organization, not incident observations reported by the source. Use them where access, logging, and audit settings permit.

Single Events

• Detect script loads from trusted sites to unknown telemetry or delivery domains and unusual high-port communications.

Timeline Correlation

• Correlate visits, fingerprinting, exploit retrieval, possible mobile-data uploads, and later cookie reuse from external IPs.

Threat Hunting

• Find managed devices still running targeted unpatched iOS or Chrome versions and review their connections to related infrastructure.

Log Gaps

• Where mobile logs are limited, correlate available SWG/proxy and IdP sign-in records; gaps do not prove that compromise did not occur.

Priority Controls

• Prioritize prompt OS/browser updates, governance of external JavaScript, CSP, and supported session-binding and anomalous-login controls.

12. Facts, Inference, and Hypothesis

Facts

• Sekoia confirmed three delivery vectors: legitimate site tampering, lookalike domains of high-profile sites, and the compromise of the Ukrainian web analytics service Plerdy.
• Plerdy was compromised from August 27 to September 3, 2026, delivering malicious scripts to numerous primarily Ukrainian sites using the tracker.
• The delivery infrastructure fingerprinted browsers and devices, delivering known and patched vulnerability chains for iOS or Android without further user interaction after an affected site is visited.
• Class A targets iOS 16.7 using CVE-2025-43529 and CVE-2024-27834 to collect cookies. Class B targets iOS 18.5 using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520, with broader device-data collection and exfiltration functions.
• The Android payload targets Chrome cookies, login data, history, and saved Wi-Fi settings. Its chain depends on the Adreno-driver vulnerability CVE-2025-27038 and stops on SM-S938B (Samsung Galaxy S25 Ultra).
• All chains utilize known, patched vulnerabilities and are ineffective on fully updated devices.
• Sekoia assesses with moderate to high confidence, based on technical overlaps, operational patterns, victimology, and infrastructure, that the actor is APT29 or a subgroup.

Individual victim-device execution and completed theft are not established by this payload analysis.

Inference

• Cookie theft can be leveraged to reuse MFA-protected browser sessions or access webmail and other services.

Hypothesis

• Specific identities of individuals infected in the campaign have not been published, and attackers may have filtered for high-value visitors.

13. MITRE ATT&CK Mapping

14. Open Questions and Further Research

• The number of infected individuals, all compromised sites, final confirmation of ties to APT29, and subsequent use of stolen sessions remain unknown.

15. Impact on SOCs and Organizations

This campaign illustrates that mobile devices, as well as PCs, are targets of sophisticated watering-hole operations, and that delayed updates leave devices exposed to n-day chains even after fixes are available. Organizations should enforce OS and browser update policies, including for BYOD, and review governance and CSP settings for external analytics tags and scripts on their websites.

16. Summary by Role

• SOCs: Correlate watering-hole visits, delivery-domain traffic, mobile browser crashes, and suspicious SaaS sign-ins that might involve stolen cookies.
• Administrators: Update all smartphones used for work and inventory third-party scripts on owned websites.
• Users: Keep the OS and browser updated, exercise caution with links, and follow organizational security notices. Legitimate sites can also be affected.