Sekoia reports a mobile espionage campaign that delivered exploits through compromised websites, lookalike sites and a poisoned analytics script. Its November 4 investigation recovered three exploit chains aimed at older iOS and Android configurations. All used vulnerabilities for which patches already existed.
Evidence status: a campaign and recovered payloads reported by the investigating security vendor. Sekoia retrieved exploit chains by presenting different browser profiles to the delivery infrastructure. Payload capabilities and the number of websites loading a tracker do not establish how many visitors were successfully compromised.
A trusted website can deliver an untrusted dependency
A watering hole is a website altered to attack its visitors. Sekoia found malicious JavaScript in legitimate sites’ templates and existing script files. Lookalike domains instead relayed real sites’ content while inserting the malicious script.
The researchers also report a compromise of Plerdy’s analytics tracker between August 27 and September 3, 2026. Websites using that third-party script could expose visitors without a separate intrusion into each website. Sekoia describes the tracker as loaded by thousands of sites, predominantly Ukrainian.
That dependency count is exposure context, not a victim total. The Plerdy-linked delivery host was offline when researchers tried to retrieve its script. They connect that part of the campaign to the recovered fingerprinting script with moderate-to-high confidence, based on matching filenames and related infrastructure.
The common loader collected device and browser attributes before requesting an appropriate exploit. Visiting a booby-trapped page was the delivery condition; the recovered chains required no additional installation or permission prompt.
Delivery selectors are not a complete affected-version list
Sekoia reports these recovered targets and capabilities:
| Observed target | Reported chain | Data targeted |
|---|---|---|
| iOS 16.7 | CVE-2025-43529 and CVE-2024-27834 | Application cookies, including Safari cookies |
| iOS 18.5 | CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 | Messaging databases, credentials, location records and other device data |
| Android Chrome 139–145, excluding 143 in the delivery logic | CVE-2026-3910 and CVE-2025-27038 | Chrome cookies, saved logins, history and Wi-Fi credentials |
These are the researchers’ observed delivery selections. They are not universal affected ranges. A browser version excluded by this delivery server is not thereby secure. The Android chain also depends on a vulnerable Adreno graphics driver, beyond its initial browser flaw.
Bill Toulas’s BleepingComputer report summarizes the same research. It is a second account of the findings, rather than independent confirmation of successful infections.
Update both the browser and the operating system
The Google-authored CVE record for CVE-2026-3910 identifies Chrome versions before 146.0.7680.75 as affected. That historical fix addresses the browser component, not every step of the Android chain. Qualcomm’s CVE record for CVE-2025-27038 identifies an Adreno driver flaw; device-specific fixes depend on the manufacturer’s update path.
Apple documents repairs for CVE-2025-43529 and CVE-2025-14174 in iOS 26.2, and CVE-2026-20700 in iOS 26.3. Those are verified historical repairs, not a recommendation to stop at those releases or a complete matrix for older devices.
- Install the latest supported operating-system and browser security updates. Check the installed versions after completion. Android users need the manufacturer’s system updates as well as Chrome updates.
- For a credible exposure, preserve available evidence and investigate account access. A stolen session cookie can let someone reuse a login without knowing its password. Review active sessions and revoke suspicious access from a trusted device through the affected service’s recovery process.
- Website operators should review third-party script exposure. Check relevant historical script changes and available logs through their normal response process. A clean tracker today cannot establish what visitors loaded during the reported interval.
Sekoia says the recovered payloads establish no persistence; BleepingComputer reports that rebooting interrupts them until another malicious visit. Rebooting does not patch the entry point or invalidate a session cookie already copied. Where forensic help is available, coordinate evidence preservation before restarting a suspected device.
Sekoia attributes the operation to APT29 with moderate-to-high confidence, citing technical overlaps, earlier activity and targeting patterns. Attribution remains an assessment. The immediate defensive actions depend on vulnerable software and potentially stolen sessions, not on proving who operated the infrastructure.
Caveat: Sekoia sells threat intelligence and security products, withholds some indicators from the public report and provides no verified total of successfully compromised visitors.