{"id":"CMP-202611-uixhxj","kind":"campaign","aliases":[],"related":[],"title":"Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)","description":null,"summary":"Sekoia (found mid-October 2026) attributes with moderate-to-high confidence to APT29 / Midnight Blizzard a watering-hole campaign against mobile visitors. Injected JavaScript on compromised legitimate sites (a Ukrainian gas producer, a US chemical-industry trade association, a European far-right party, a Bulgarian military-related site), on lookalike reverse-proxy sites impersonating America250 and Raffles London at The OWO, and in the Plerdy SEO tracker (a.plerdy.com, loaded by thousands of mostly Ukrainian sites) between 27 Aug and 3 Sep 2026, profiles the device and serves a zero-click n-day exploit chain: iOS 16.7 (cookie theft), iOS 18.5 (DarkSword chain: WhatsApp/Telegram databases, Keychain, location, photos), Chrome for Android 139-145 except 143 (cookies, saved logins, history, Wi-Fi passwords). Stolen session cookies can be reused to get into webmail and other accounts. No persistence; all flaws are already patched and fully updated devices are not affected. Number of victims unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T09:43:10+00:00","products":[{"name":"iOS","fixed":[],"vendor":"Apple"},{"name":"Chrome for Android","fixed":[],"vendor":"Google"},{"name":"Plerdy","fixed":[],"vendor":"Plerdy"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Web/DNS/proxy logs for: static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, ad.starx-net[.]com (incl. :8881/telemetry/v12), america250[.]holiday (192.121.46[.]25), theowo[.]club (188.190.17[.]232); requests for 5b4c8fea5cbcee273e8d830f52-temfp.js; a cookie named VDGH_TOKEN_REF. Sites that load the Plerdy tracker (a.plerdy.com/public/js/click/main.js) exposed their visitors 27 Aug-3 Sep 2026; check your site templates and JS files for an injected script loading the domains above. Mobile fleets: iPhones below current iOS (notably 16.x-17.4 and 18.5) and Chrome for Android 139-145. Payload hashes (sha256): bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088, 35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef, 621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a, 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f.","fix":"Update iOS/iPadOS and Chrome for Android to the latest version on every device (MDM: enforce minimum OS/browser version). Block the listed domains and IPs. If a device on an old version visited the listed sites or a Plerdy-tracked site in the window, reboot it (no persistence), sign out all sessions and change passwords for webmail and other accounts used on it, and change Wi-Fi passwords it had saved. Sites using Plerdy: review the tracker and your own JS for injected code.","status":"open","published_at":null,"first_seen_at":"2026-11-04T09:43:10+00:00","triaged_at":"2026-11-04T09:43:10+00:00","updated_at":"2026-11-04T09:43:44+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-145':174B '-202611':33A '139':173B '143':176B '16.7':158B '18.5':162B '2026':59B,142B '27':137B '3':140B 'a.plerdy.com':128B 'account':197B 'affect':211B 'alreadi':203B 'america250':115B 'analyt':12A 'android':20A,48A,172B 'androsnitch':42A 'apt29':3A,35A,68B 'associ':95B 'attribut':60B 'aug':138B 'bear':39A 'blizzard':37A,70B 'bulgarian':103B 'campaign':50B,75B 'chain':156B,164B 'chat':30A 'chemic':92B 'chemical-industri':91B 'chrome':21A,46A,170B 'click':151B 'clone':6A 'cmp':32A 'compromis':82B 'compromise':44A 'confid':66B 'cooki':27A,159B,177B,187B 'cozy':38A 'darksword':40A,163B 'databas':166B 'day':154B 'devic':145B,208B 'earli':52B 'early-warn':51B 'european':97B 'except':175B 'exploit':24A,155B 'far':99B 'far-right':98B 'fi':183B 'flaw':201B 'for':47A 'found':55B 'fulli':206B 'gas':87B 'get':192B 'hack':4A 'high':65B 'hijack':9A 'histori':180B 'hit':16A 'hole':74B 'imperson':114B 'industri':93B 'inject':79B 'io':157B,161B 'ios':45A 'iphon':18A 'javascript':80B 'keychain':167B 'known':23A 'legitim':83B 'load':129B 'locat':168B 'login':179B 'london':118B 'lookalik':109B 'mid':57B 'mid-octob':56B 'midnight':36A,69B 'militari':105B 'military-rel':104B 'mobil':77B 'moder':63B 'moderate-to-high':62B 'most':133B 'n':153B 'n-day':152B 'number':212B 'octob':58B 'owo':121B 'parti':101B 'password':28A,184B 'patch':204B 'persist':199B 'photo':169B 'plerdi':11A,125B 'plerdy':43A,49A 'produc':88B 'profil':143B 'proxi':112B 'raffl':117B 'relat':106B 'reus':190B 'revers':111B 'reverse-proxi':110B 'right':100B 'russia':1A 'save':178B 'script':13A 'sekoia':31A,54B 'seo':126B 'sep':141B 'serv':147B 'session':186B 'silent':15A 'site':84B,107B,113B,135B 'steal':26A 'stolen':185B 'theft':160B 'thousand':131B 'tracker':127B 'trade':94B 'uixhxj':34A 'ukrainian':86B,134B 'ultimatefingerprinter':41A 'unknown':215B 'unpatch':17A 'updat':207B 'us':90B 'victim':214B 'visitor':78B 'warn':53B 'water':73B 'watering-hol':72B 'webmail':194B 'websit':7A 'whatsapp/telegram':165B 'wi':182B 'wi-fi':181B 'zero':150B 'zero-click':149B","nicknames":["APT29","Midnight Blizzard","Cozy Bear","DarkSword","UltimateFingerprinter","AndroSnitch","Plerdy compromise"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["androsnitch","apt29","chromeforandroid","cozybear","darksword","forandroid","ios","midnightblizzard","plerdy","plerdycompromise","ultimatefingerprinter"],"ptokens":["android","chrome","for","ios","plerdy"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"exploitation","first_public_at":"2026-10-15T16:30:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-uixhxj","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T09:43:10+00:00","fetched_at":"2026-11-04T09:43:10+00:00","note":null}],"documents":[{"id":65815,"url":"https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits","title":"Poisoned Source: APT29 watering holes target mobile devices with n-day exploits","kind":"blog","source":"analyst","publisher":null,"text":"Sekoia TDR: APT29 (Midnight Blizzard) watering hole campaign found mid-October 2026. Three vectors: JS injection on compromised legitimate sites (Ukrainian gas producer, US chemical industry trade association, European far-right party, Bulgarian military-related site), AiTM reverse-proxy lookalikes america250[.]holiday (192.121.46[.]25) and theowo[.]club (188.190.17[.]232), and compromise of Plerdy SEO tracker a.plerdy[.]com/public/js/click/main.js between 27 Aug and 3 Sep 2026. Fingerprinting script 5b4c8fea5cbcee273e8d830f52-temfp.js (UltimateFingerprinter) on static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com, redirects to ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com. Exploit chains: iOS 16.7 CVE-2025-43529+CVE-2024-27834 (cookies); iOS 18.5 DarkSword CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 (full device data, WhatsApp/Telegram, Keychain); Android Chrome 139-145 (not 143) CVE-2026-3910+CVE-2025-27038 (Chrome cookies, logins, Wi-Fi passwords, AndroSnitch). Exfil ad.starx-net[.]com(:8881/telemetry/v12). Marker cookie VDGH_TOKEN_REF. No persistence. All flaws patched; up-to-date devices safe.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":4260,"url":"https://x.com/ReversingLabs/status/2110770379006374358","title":"@ReversingLabs: Before Anthropic's Midnight Blizzard report, ReversingLabs had already classifie","kind":"post","source":"x","publisher":null,"text":"Before Anthropic's Midnight Blizzard report, ReversingLabs had already classified the malware as malicious.\n\n5 builds. 5 hashes. Same malicious behavior.\n\nAI accelerates malware changes. It can't erase the evidence.\n\nIgor Lasic explains: https://t.co/CuW4ewD9QN \n\n#ThreatIntel\n\nlikes 3 reposts 0","published_at":"2026-10-15T16:30:49+00:00","relation":"discussion","confidence":null,"note":"@ReversingLabs"},{"id":4306,"url":"https://x.com/Unit42_Intel/status/2112321704148033732","title":"@Unit42_Intel: We've noted a group of domains associated with #Coruna-like and #DarkSword iOS e","kind":"post","source":"x","publisher":null,"text":"We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open the content using Safari on their iPhone. More info at https://t.co/Xqx9stQGBf https://t.co/2IxKfKNCdQ\n\nlikes 82 reposts 13","published_at":"2026-10-19T23:15:13+00:00","relation":"discussion","confidence":null,"note":"@Unit42_Intel"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}