APT29 linked to Plerdy analytics script hijack that served patched iOS and Android exploits

TLDR

• Sekoia attributes a watering-hole campaign, including a hijacked Plerdy analytics script, to APT29 with moderate to high confidence.¹
• CISA added Apple flaw CVE-2024-27834, used in one analysed iOS chain, to its KEV catalogue on 4 November.⁵
• The Hacker News gives a federal deadline of 18 November; SecurityWeek says two weeks.⁶⁸

French security firm Sekoia published research on 4 November 2026 describing a watering-hole campaign it attributes to APT29, also known as Midnight Blizzard or Cozy Bear.¹ The Hacker News reports that the campaign, codenamed Poisoned Source, was discovered in mid-October 2026 and uses three infection vectors: compromised legitimate websites, lookalike sites, and a supply chain compromise of the Plerdy SEO Tracker.² Sekoia says it assesses with moderate to high confidence that APT29 conducted the campaign, and allows that the actor may be at least one of its subgroups.¹ It cites a partner CERT that matched leftover traces on one compromised site to a private report on a 2025 APT29 watering hole, and says Google's Threat Analysis Group found the framework resembles APT29's 2024 campaign against Mongolian government sites.¹ Sekoia rates only at low confidence its assessment that specific sites were selected to reach particular individuals.¹

On Plerdy, Sekoia says the Ukrainian analytics tracker was compromised between 27 August and 3 September 2026, with its main.js file modified so that visitors also loaded a script from a second domain.¹ Sekoia says thousands of sites, mostly Ukrainian, load the tracker, but could not retrieve the injected script because the host was offline.¹ BleepingComputer reports that thousands of sites loaded the altered tracker in that period, while Infosecurity Magazine says the compromise exposed hundreds of sites and that the researchers gave no figure for compromised devices.³⁴ Other victims named include a Ukrainian gas production company, a US chemical-industry trade association and a Bulgarian military-related site, and lookalike domains imitated the America250 site and Raffles London at The OWO hotel.¹³ Sekoia lists the US, Ukraine, the Czech Republic and Bulgaria among the affected countries.¹ It says it remains unclear whether attackers targeted visitors to specific sites or sought to compromise as many unpatched devices as possible.²

Every variant loads JavaScript that profiles the visitor's device and browser, after which the delivery infrastructure sends a platform-specific exploit chain.² Sekoia describes three: one for iOS 16.7 using CVE-2025-43529 and CVE-2024-27834 to steal cookies; one for iOS 18.5 using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to take full device data; and one for Chrome 139 to 145 on Android, excluding 143, using CVE-2026-3910 and CVE-2025-27038 to deliver a stealer it calls AndroSnitch.¹ Sekoia identifies the iOS 18.5 chain as DarkSword, which it describes as a suspected commercial surveillance vendor kit, and concludes APT29 likely obtained the exploits from a third party.¹ The Android payload takes Chrome cookies, login data and history plus Wi-Fi configuration files.¹ Sekoia says the payloads work without establishing persistence, and BleepingComputer reports that rebooting a device halts the activity until the user visits a compromised site again.¹³

Sekoia states that none of the chains contain zero-days or work against fully updated devices.¹ BleepingComputer reports that Apple and Google have patched every flaw used, including fixes for older iOS releases, and Infosecurity Magazine quotes Sekoia saying a user on an up-to-date operating system is safe from these attacks.³⁴ Sekoia's report gives no statements from Plerdy, Apple, Google or Samsung.¹ The Hacker News adds that iVerify and Report URI separately detailed a DarkSword variant delivered through ad-based infrastructure, and that Zimperium counted 608 domains delivering Coruna-family code as of October 2026.² BleepingComputer says DarkSword was first documented in March and has been used by multiple groups since at least November 2025.³ Sekoia says it is coordinating with the CERTs of affected countries and exploring ways to disrupt the infrastructure.¹

Why it matters: a compromised third-party analytics script gave attackers reach across thousands of sites without breaching each one, one Apple flaw from the chains is now on CISA's exploited-vulnerability list, and Sekoia says only fully updated devices were safe from the chains it analysed.¹⁵

Update, 6 November 2026: CISA added CVE-2024-27834, one of the Apple flaws in the iOS 16.7 chain Sekoia describes, to its Known Exploited Vulnerabilities (KEV) catalogue on 4 November, saying it did so based on evidence of active exploitation.⁵ The alert lists it as an Apple Multiple Products improper authentication vulnerability and gives no remediation date, but cites Binding Operational Directive 26-04, which it says applies only to Federal Civilian Executive Branch (FCEB) agencies.⁵ The Hacker News reports a CVSS score of 5.5, says the flaw lets an attacker with arbitrary read and write capability bypass Pointer Authentication, and says Apple fixed it in May 2024 with iOS 16.7.8, iOS 17.5 and related releases.⁶ It gives 18 November 2026 as the date by which FCEB agencies should patch, while SecurityWeek says CISA told agencies to patch within two weeks.⁶⁸ The Hacker News adds that the flaw was demonstrated as a zero-day at Pwn2Own Vancouver in March 2024.⁶ Dark Reading lists the iOS 16.7 chain as CVE-2025-43529 and CVE-2024-27834, whereas The Hacker News text names CVE-2025-43529 for both the WebKit remote code execution flaw and the Pointer Authentication bypass.⁶⁹

Coverage from The Record, SecurityWeek and Dark Reading adds some victim detail. The Record and SecurityWeek say the compromised sites included a far-right European political party, and both report that the Plerdy script exposed visitors to hundreds of sites, among them sites linked to the Ukrainian military, special forces and makers of drones and other military equipment.⁷⁸ Dark Reading says the Plerdy compromise lasted a week and potentially exposed thousands of iPhone and Android users.⁹ It quotes Sekoia as saying no single sectoral targeting pattern emerges across the directly compromised sites, with victims including an Australian medical clinic.⁹ The Record says Sekoia did not establish how many smartphones were compromised or how much data was taken.⁷

On the lookalike Raffles London at The OWO site, SecurityWeek quotes Sekoia saying the impersonation may have aimed at diplomatic delegations and high-profile guests, noting Ukrainian President Volodymyr Zelensky stayed at the hotel on 14 October.⁸ The Record says the researchers found no evidence he was targeted.⁷ The Record also says DarkSword has previously been used in operations targeting users in Saudi Arabia, Turkey and Malaysia.⁷ SecurityWeek says CVE-2026-3910 was patched in March as a zero-day, and that the AndroSnitch payload resembles AndroSnatch, a Chrome cookie stealer Google's Threat Analysis Group observed in Midnight Blizzard attacks between 2023 and 2024.⁸ Sekoia assesses, as quoted by SecurityWeek and Dark Reading, that reuse of commercial surveillance vendor exploits among state-sponsored groups will likely become more frequent.⁸⁹