Sekoia says APT29, or a subgroup, hijacked the tracking script of Ukrainian web analytics service Plerdy from August 27 to September 3, 2026, assessing the link with moderate to high confidence. Thousands of mostly Ukrainian websites load the script, so the injected code potentially reached their visitors’ phones. The same Russia-linked group also seeded compromised and lookalike sites.
Those watering holes included the sites of a US chemical-industry trade association, a Ukrainian gas producer, and a Bulgarian military-related organization, and Sekoia found no single sector being targeted. A fingerprinting script profiled each visiting phone, then served an exploit chain for flaws already patched but still open on that device.
On iOS 18.5, the DarkSword chain, which Sekoia suspects came from a commercial spyware vendor, could take messages, WhatsApp and Telegram chats, passwords, and photos. An iOS 16.7 chain went after browser cookies, and an Android chain went after Chrome data and Wi-Fi passwords. Sekoia warns that packaged chains like these lower the bar for advanced mobile attacks.
Source: Dark Reading
