Russia-linked APT29 hit old iPhones and Android phones through hacked websites and a poisoned analytics script

A hacking campaign that French security firm Sekoia attributes to APT29, the Russian group also known as Midnight Blizzard and Cozy Bear, planted exploit code on legitimate websites so that simply visiting them could compromise an out-of-date phone. Sekoia published its report, "Poisoned Source," on November 4. It describes three delivery routes, three exploit chains for iOS and Android, and payloads that copy messages, passwords and photos off the phone. One route was a week-long compromise of Plerdy, a Ukrainian web-analytics script that Sekoia says thousands of sites load.

Why it matters: none of the bugs were new. Sekoia says every flaw in the three chains had already been patched by the vendors before the campaign began, and that a phone on an up-to-date operating system was safe. The victims were people whose phones had fallen behind on updates. On the same day, CISA added one of the iOS bugs, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog, according to The Hacker News.

How the attack reached people

Sekoia says it spotted the operation in mid-October. It found three ways the same device-profiling code reached visitors:

• Hacked legitimate sites. JavaScript was injected into page templates or appended to existing scripts. Sekoia's examples include a Bulgarian military-related site and a US chemical-industry trade association.
• Lookalike domains. Reverse proxies copied real sites and injected the script on the fly. Sekoia names domains impersonating America250 and the Raffles London at The OWO hotel.
• A supply-chain hit on Plerdy. Malicious code was served through Plerdy's tracker at a.plerdy[.]com from August 27 to September 3, 2026. Help Net Security reports that the script runs mostly on Ukrainian sites, including some run by the army, special forces and military-equipment makers.

The script checked each visitor's device and served an exploit chain only if it matched. It isn't clear whether the operators targeted specific visitors or took every phone they could get.

The three exploit chains

Stolen cookies matter even on their own: Help Net Security notes they can let an attacker reuse a logged-in session, such as webmail. Sekoia says none of the payloads persist on the device. That makes infections hard to spot afterwards, but the data has already left the phone.

Sekoia's attribution to APT29 is "moderate to high confidence." Help Net Security summarizes the evidence: traces of a 2025 APT29 watering-hole operation on one of the compromised sites, overlaps with a 2024 APT29 campaign against Mongolian government sites that Google confirmed, and a victim list centered on Ukraine. Sekoia says it is working with national CERTs, including CERT-UA, to identify victims and take down the infrastructure.

The CISA angle

CVE-2024-27834 is a 2024 bug that lets an attacker who already has memory read/write access bypass Pointer Authentication, one of Apple's exploit defenses. Apple fixed it in May 2024 in iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5 and Safari 17.5, according to The Hacker News. CISA's addition on November 4 gives US federal civilian agencies until November 18 to patch.

What to do

• iPhone and iPad: Go to Settings > General > Software Update and install the newest version your device supports. Chain A targets iOS 16 and early iOS 17, and chain B targets iOS 18.5.
• Android: Update Chrome from the Play Store and install the latest system security update. Chain C needs Chrome 139–145 and an unpatched Adreno GPU driver.
• If a phone no longer gets updates, treat it as exposed to this kind of attack. Don't use it for work email, messaging or password managers.
• Organizations: Use mobile device management to block or flag phones below a minimum OS version, and check DNS or proxy logs for the indicators Sekoia lists. Its delivery and exfiltration hosts include ad.starx-net[.]com, static.flux-telemetry[.]com, adsprism-stat[.]com, theowo[.]club and america250[.]holiday. Sekoia says it is holding back further indicators and YARA rules for CERTs and customers.
• Site owners who embed Plerdy: If your pages loaded the tracker between August 27 and September 3, your visitors may have been served the exploit code. Review that period and consider who your audience is.

The bigger lesson, as Sekoia notes, is that packaged chains of already-patched bugs lower the barrier to advanced mobile attacks. Patching quickly protects you. Old phones that no longer get updates are the targets.