unpatched/intel
Latest briefing
Patch nowExploitedKEVhighAPT / Nation-State

APT29 deploys mobile exploit kits via hijacked analytics and watering holes

By Harith Dilshan2 min read

TL;DR

APT29-linked actors are using hacked websites, lookalike proxy domains and a hijacked analytics script to push mobile exploit chains to iOS and Android users. The zero-click browser exploits steal cookies, passwords and, on iOS 18.5, full device data. Every flaw in the chains is already patched, so update iOS, Android and Chrome now.

What happened

A large-scale watering hole campaign, which Sekoia details in its Poisoned Source report, has been targeting mobile users through compromised websites, lookalike domains, and a supply chain attack on the Plerdy SEO Tracker. Sekoia attributes it to APT29 with moderate to high confidence. Between August 27 and September 3, 2026, attackers injected malicious code into a.plerdy[.]com/public/js/click/main.js to profile visitor devices and serve platform-specific exploits.

The infrastructure delivers the DarkSword exploit kit to iOS 18.5, a cookie-stealing chain to iOS 16.7, and the AndroSnitch payload to Android users. The exploits fire when a visitor simply loads a compromised or proxied website, with no further user interaction. Compromised sites include a Ukrainian gas production company, a US chemical industry trade association, a far-right European political party, and a Bulgarian military-related website.

The iOS 16.7 chain uses CVE-2025-43529 and CVE-2024-27834. DarkSword adds CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to CVE-2025-43529. The Android chain uses CVE-2026-3910 and CVE-2025-27038.

Why it matters

This is an automated way to weaponize N-day vulnerabilities. Because the chains run as soon as a user loads a compromised page, with no click needed, attackers bypass traditional user caution. DarkSword takes everything from Safari cookies and Keychain passwords to iMessages, photos, and Apple Health data. AndroSnitch takes Chrome cookies, saved logins and Wi-Fi configuration files. Reusing packaged N-day exploit chains lets a state-sponsored actor reach large numbers of unpatched mobile devices through ordinary web traffic.

Who is affected

  • iOS users: Sekoia observed chains for iOS 16.7 (possibly 16.0 to 17.4) and iOS 18.5. Treat any iPhone not on current iOS as at risk.
  • Android users: Running Chrome versions 139 through 145 (excluding version 143).
  • Plerdy SEO Tracker users: Thousands of mostly Ukrainian sites, including military ones, loaded the compromised a.plerdy[.]com script.
  • Visitors to compromised sites: Anyone who loaded the hacked sites above or the lookalike proxies of america250.org and the Raffles London at The OWO.

What to do now

  1. Update iOS, Android and Chrome to the latest versions. Sekoia says an up-to-date operating system is safe from these attacks.
  2. Monitor network traffic for connections to ad.starx-net[.]com:8881/telemetry/v12 and static.flux-telemetry[.]com.
  3. Audit all third-party web analytics and tracking scripts for unauthorized modifications.
  4. Rotate sensitive credentials if an unpatched device may have visited an affected site.

What we don't know yet

  • Whether the attackers intended to target specific individuals or sought to mass-exploit unpatched devices.
  • The reason why Chrome version 143 is explicitly excluded from the Android attack chain.
  • The total number of victims of the Plerdy compromise and the other compromised and proxied sites.

Sources

  1. thehackernews.comhttps://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html
  2. sekoia.comhttps://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
  3. iverify.comhttps://www.iverify.com/blog/malvertising-coruna-darksword-iphone-exploits
  4. zimperium.comhttps://zimperium.com/blog/inside-coruna-and-darksword-chains-from-web-lures-to-ios-exploitation

Offensive security engineer, ethical hacker and penetration tester. Writes Unpatched Intel from h4rithd.com.

Patch nowExploitedKEVhighAPT / Nation-StateNew

Gorbag targets Ukrainian organizations using a WinRAR flaw to steal sensitive data

Russia-aligned group Gorbag is targeting Ukrainian law enforcement and justice bodies, front-line local administrations and the defense sector. It relies on simple infostealers and a reverse shell, and one entry point is the WinRAR flaw CVE-2025-8088, which ESET says leads to a BeautyStealer variant that takes browser data, VPN and RDP configurations and documents. Update WinRAR to close CVE-2025-8088 and treat macro-enabled Office attachments with suspicion.

CVE-2025-80882 min
MonitorhighAPT / Nation-StateNew

Laundry Bear exploits Exchange OWA zero-day to deploy persistent OWAReaper backdoor via email

The Russian state-sponsored group Laundry Bear (TA488) is using a "half-click" exploit against Microsoft Exchange Outlook Web Access (OWA) to deploy the OWAReaper backdoor. Victims only need to open a malicious email to trigger the compromise via CVE-2026-42897. Because the malware achieves server-side persistence, rotating credentials or re-imaging workstations will not remove the attacker's access.

4 min