CAMPAIGNNO CVE YET

EXPLOITED
IN THE WILD

IOS · CMP-202611-uixhxj · Vendor

APT29Midnight BlizzardCozy BearDarkSwordUltimateFingerprinterAndroSnitchPlerdy compromiseEarly warning · no CVE yet

Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)

NO FIX YET · SEE WHAT TO DO

Sekoia (found mid-October 2026) attributes with moderate-to-high confidence to APT29 / Midnight Blizzard a watering-hole campaign against mobile visitors. Injected JavaScript on compromised legitimate sites (a Ukrainian gas producer, a US chemical-industry trade association, a European far-right party, a Bulgarian military-related site), on lookalike reverse-proxy sites impersonating America250 and Raffles London at The OWO, and in the Plerdy SEO tracker (a.plerdy.com, loaded by thousands of mostly Ukrainian sites) between 27 Aug and 3 Sep 2026, profiles the device and serves a zero-click n-day exploit chain: iOS 16.7 (cookie theft), iOS 18.5 (DarkSword chain: WhatsApp/Telegram databases, Keychain, location, photos), Chrome for Android 139-145 except 143 (cookies, saved logins, history, Wi-Fi passwords). Stolen session cookies can be reused to get into webmail and other accounts. No persistence; all flaws are already patched and fully updated devices are not affected. Number of victims unknown.

Use IOS? Find out in 2 minutes.

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

iOS
Chrome for Android
Plerdy

Who cares campaign

02 · How to check

Web/DNS/proxy logs for: static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, ad.starx-net[.]com (incl. :8881/telemetry/v12), america250[.]holiday (192.121.46[.]25), theowo[.]club (188.190.17[.]232); requests for 5b4c8fea5cbcee273e8d830f52-temfp.js; a cookie named VDGH_TOKEN_REF
Sites that load the Plerdy tracker (a.plerdy.com/public/js/click/main.js) exposed their visitors 27 Aug-3 Sep 2026; check your site templates and JS files for an injected script loading the domains above
Mobile fleets: iPhones below current iOS (notably 16.x-17.4 and 18.5) and Chrome for Android 139-145
Payload hashes (sha256): bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088, 35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef, 621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a, 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f

03 · The fix

Update iOS/iPadOS and Chrome for Android to the latest version on every device (MDM: enforce minimum OS/browser version)
Block the listed domains and IPs
If a device on an old version visited the listed sites or a Plerdy-tracked site in the window, reboot it (no persistence), sign out all sessions and change passwords for webmail and other accounts used on it, and change Wi-Fi passwords it had saved

Exploited: Yes, in the wild
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

What people are saying

X · 2 posts · 1 article

@Unit42_IntelOct 19, 2026We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open the content using Safari on their iPhone. More info at @ReversingLabsOct 15, 2026Before Anthropic's Midnight Blizzard report, ReversingLabs had already classified the malware as malicious. 5 builds. 5 hashes. Same malicious behavior. AI accelerates malware changes. It can't erase the evidence. Igor Lasic explains: #ThreatIntel

How it unfolded

4 events · Oct 15, 2026 → Nov 4, 2026

Oct 15, 202616:30 UTC@ReversingLabs Before Anthropic's Midnight Blizzard report, ReversingLabs had already classified the malware as malicious. 5 builds. 5 hashes. Same malicious behavior. AI ac
Oct 19, 202623:15 UTC@Unit42_Intel We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open
Nov 4, 2026sekoia.com Poisoned Source: APT29 watering holes target mobile devices with n-day exploits

Get the next IOS threat the day it hits your stack.

Start watching free

Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)

01 · Who is affected

02 · How to check

03 · The fix

What people are saying

How it unfolded

Read next

Get the next IOS threat the day it hits your stack.

Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)

01 · Who is affected

02 · How to check

03 · The fix

What people are saying

How it unfolded

Read next

Get the next IOS threat the day it hits your stack.

Sources and references