Sekoia Details APT29-Linked Watering-Hole Campaign Using Patched Mobile Exploits

Nov 4, 2026 · Original article ↗

Summary

Sekoia details a watering-hole campaign assessed with moderate-to-high confidence as APT29, using compromised sites and Plerdy to deliver patched iOS and Android exploits that stole cookies, Wi-Fi passwords and device data.

Key points

Sekoia assesses with moderate-to-high confidence that APT29, or a subgroup, conducted the campaign, citing technical overlaps, operational patterns, victimology and infrastructure.
The campaign used compromised websites, lookalike reverse proxies that injected JavaScript, and a one-week compromise of the Ukrainian Plerdy analytics tracker.
The UltimateFingerprinter script profiled visitors before delivering platform-specific exploit chains; investigators found little evidence that most collected fingerprint data affected exploit delivery.
The iOS chains targeted known, patched flaws and could steal cookies or harvest extensive device data, including messages, credentials, location information and media.
The Android chain targeted unpatched Chrome versions and collected browser data and saved Wi-Fi passwords.
All analyzed chains used known, already-patched vulnerabilities; the report says fully updated devices are not vulnerable to these attacks.
Sekoia coordinated with affected countries' CERTs to support victim identification and assess disruption options.

Article Details

Attack Vectors: JavaScript was injected into compromised legitimate websites, including site templates and existing JavaScript files, to load a visitor-fingerprinting script.
Attacker-controlled lookalike domains acted as reverse proxies, modifying legitimate websites' HTML to inject malicious JavaScript.
A one-week compromise of the Ukrainian Plerdy SEO Tracker injected code into its JavaScript file, exposing visitors across thousands of sites to the delivery chain.
The injected code profiled browser and device attributes and served platform-specific n-day exploit chains to unpatched iOS and Android devices without user interaction.
The exploit chains collected browser cookies, Chrome data, Wi-Fi passwords, and, in some iOS cases, broader device data for exfiltration.
Defensive Notes: Keep iOS, Android, and Chrome updated. The report says the chains used known, patched vulnerabilities and that fully updated devices were not vulnerable to them.
Review website templates, existing JavaScript files, and third-party tracker resources for unauthorized modifications or inclusions.
Investigate possible exposure through the Plerdy tracker compromise between 2026-08-27 and 2026-09-03.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ads-it-assets[.]com`	Malicious delivery server receiving redirected traffic from the campaign's load-balancing host.
DOMAIN	`adsprism-stat[.]com`	Malicious delivery domain associated with the america250[.]holiday reverse-proxy operation.
DOMAIN	`america250[.]holiday`	Attacker-controlled reverse-proxy domain used to inject malicious JavaScript into a legitimate website.
DOMAIN	`assets-int[.]com`	Malicious delivery server receiving redirected traffic from the campaign's load-balancing host.
DOMAIN	`cdn[.]adv-static[.]com`	Malicious delivery server receiving redirected traffic from the campaign's load-balancing host.
DOMAIN	`edge-ord[.]clouds-stacks[.]com`	Malicious delivery host assessed to distribute traffic across the campaign's delivery infrastructure.
DOMAIN	`theowo[.]club`	Attacker-controlled reverse-proxy domain used to inject malicious JavaScript into a legitimate website.
DOMAIN	`wpvortex-mod[.]com`	Malicious delivery server receiving redirected traffic from the campaign's load-balancing host.
IPV4	`188[.]190[.]17[.]232`	IP address associated with the attacker-controlled theowo[.]club reverse proxy.
IPV4	`192[.]121[.]46[.]25`	IP address associated with the attacker-controlled america250[.]holiday reverse proxy.
IPV4	`195[.]58[.]140[.]105`	IP address associated with the campaign's ad.starx-net[.]com exfiltration host.
IPV4	`95[.]133[.]231[.]28`	IP address associated with the malicious edge-ord.clouds-stacks[.]com delivery host.
SHA256	`06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f`	SHA-256 of the Class C Android exploit-chain Stage 2 JavaScript sample.
SHA256	`183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8`	SHA-256 of the Android shellcode containing the CVE-2025-27038 exploit.
SHA256	`29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928`	SHA-256 of the Class C Android exploit-chain Stage 1 JavaScript sample.
SHA256	`2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa`	SHA-256 of the Class B iOS exploit-chain Stage 2 sample listed in the report's hash table.
SHA256	`35c0cd19a7334b544c193e392bcd9a8f1d1f43cf6b61be5bf1d9e35537aff2ef`	SHA-256 of the Class B iOS exploit-chain Stage 1 payload.
SHA256	`387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c`	SHA-256 of the Android AndroSnitch data-collection payload.
SHA256	`41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967`	SHA-256 of the Class C Android payload variant served to Chrome version 145.
SHA256	`621112712ec515e8791129c62feda8fff6654a0116882401609503cacc08054a`	SHA-256 of the Class B iOS exploit-chain Stage 2 payload.
SHA256	`69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f`	SHA-256 of the Class B iOS exploit-chain Stage 3 payload.
SHA256	`a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3`	SHA-256 of the Class A iOS exploit-chain Stage 1 sample.
SHA256	`ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108`	SHA-256 of the Class C Android payload variant served to Chrome versions 139–144.
SHA256	`bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088`	SHA-256 of the Class A iOS cookie-stealing exploit sample.
SHA256	`c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa`	SHA-256 of the Class B iOS exploit-chain Stage 1 sample listed in the report's hash table.
URL	`hxxps[:]//a[.]plerdy[.]com/public/js/click/main.js`	Specific Plerdy tracker resource compromised to inject the campaign's malicious fingerprinting code.
URL	`hxxps[:]//ad[.]starx-net[.]com:8881/telemetry/v12`	Exfiltration endpoint used by the iOS and Android payloads to send collected data.
URL	`hxxps[:]//static[.]flux-telemetry[.]com/api/uGmlx2pmMHU1jq7wZU2QWgeC28vbXalf/v1`	Fingerprinting endpoint that receives visitor data and returns JavaScript exploit code.
URL	`hxxps[:]//static[.]flux-telemetry[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js`	Malicious fingerprinting script delivered to visitors of compromised websites.