---
id: "CMP-202611-uixhxj"
kind: "campaign"
aliases: []
title: "Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "iOS", "fixed": [], "vendor": "Apple"}, {"name": "Chrome for Android", "fixed": [], "vendor": "Google"}, {"name": "Plerdy", "fixed": [], "vendor": "Plerdy"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T09:43:10+00:00"
updated_at: "2026-11-04T09:43:44+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T09:43:10+00:00"}]
---

# Russia's APT29 hacks and clones websites, and hijacked the Plerdy analytics script, to silently hit unpatched iPhones and Android Chrome with known exploits that steal cookies, passwords and chats (Sekoia)

Sekoia (found mid-October 2026) attributes with moderate-to-high confidence to APT29 / Midnight Blizzard a watering-hole campaign against mobile visitors. Injected JavaScript on compromised legitimate sites (a Ukrainian gas producer, a US chemical-industry trade association, a European far-right party, a Bulgarian military-related site), on lookalike reverse-proxy sites impersonating America250 and Raffles London at The OWO, and in the Plerdy SEO tracker (a.plerdy.com, loaded by thousands of mostly Ukrainian sites) between 27 Aug and 3 Sep 2026, profiles the device and serves a zero-click n-day exploit chain: iOS 16.7 (cookie theft), iOS 18.5 (DarkSword chain: WhatsApp/Telegram databases, Keychain, location, photos), Chrome for Android 139-145 except 143 (cookies, saved logins, history, Wi-Fi passwords). Stolen session cookies can be reused to get into webmail and other accounts. No persistence; all flaws are already patched and fully updated devices are not affected. Number of victims unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :iOS affected ? fixed ?
- :Chrome for Android affected ? fixed ?
- :Plerdy affected ? fixed ?

## How to check

Web/DNS/proxy logs for: static.flux-telemetry[.]com (109.104.106[.]107), edge-ord.clouds-stacks[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, ad.starx-net[.]com (incl. :8881/telemetry/v12), america250[.]holiday (192.121.46[.]25), theowo[.]club (188.190.17[.]232); requests for 5b4c8fea5cbcee273e8d830f52-temfp.js; a cookie named VDGH_TOKEN_REF. Sites that load the Plerdy tracker (a.plerdy.com/public/js/click/main.js) exposed their visitors 27 Aug-3 Sep 2026; check your site templates and JS files for an injected script loading the domains above. Mobile fleets: iPhones below current iOS (notably 16.x-17.4 and 18.5) and Chrome for Android 139-145. Payload hashes (sha256): bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088, 35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef, 621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a, 69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f.

## Fix

Update iOS/iPadOS and Chrome for Android to the latest version on every device (MDM: enforce minimum OS/browser version). Block the listed domains and IPs. If a device on an old version visited the listed sites or a Plerdy-tracked site in the window, reboot it (no persistence), sign out all sessions and change passwords for webmail and other accounts used on it, and change Wi-Fi passwords it had saved. Sites using Plerdy: review the tracker and your own JS for injected code.

## Timeline

- 2026-11-04T09:43:10+00:00 analyst

## Documents

- [describes] Poisoned Source: APT29 watering holes target mobile devices with n-day exploits https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
- [discussion] @ReversingLabs: Before Anthropic's Midnight Blizzard report, ReversingLabs had already classifie https://x.com/ReversingLabs/status/2110770379006374358
- [discussion] @Unit42_Intel: We've noted a group of domains associated with #Coruna-like and #DarkSword iOS e https://x.com/Unit42_Intel/status/2112321704148033732

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_