A large-scale espionage campaign spent part of the autumn turning ordinary websites into infection infrastructure for phones — and it did so without a single zero-day. Sekoia's Threat Detection and Research team published an analysis on November 4 describing a watering-hole operation active since mid-October 2026 that served zero-interaction exploit chains to iOS and Android visitors. Every vulnerability it used had already been fixed by Apple and Google.

The conclusion that matters for defenders is uncomfortable: a phone is only safe if it is actually updated. There is no novel bug to wait for a patch on, no vendor advisory to race. The attackers simply assumed a large enough population of unpatched devices exists, and were right.

Sekoia assesses with moderate to high confidence that the campaign belongs to APT29 — also tracked as Midnight Blizzard, Cozy Bear or the Dukes — an intrusion set widely attributed to Russia's Foreign Intelligence Service. The company says it is coordinating with national CERTs on victim identification, and credits CERT-UA and Google's TAG team for assistance.

Three ways in

The campaign used three delivery routes, all ending in the same JavaScript loader.

The first was direct injection into legitimate sites. On a Ukrainian gas production company, attackers added a script to the site's main template that, once the page loaded, appended an external file called by its authors "UltimateFingerprinter." Similar tampering hit the site of a major US chemical-industry trade association, a Bulgarian military-related site and a far-right European political party.

The second was a reverse-proxy impersonation: register a lookalike domain, pass through the real site's content, and splice in the malicious script on the fly. Two such domains stood out. `america250[.]holiday` proxied america250.org, the official site of the national initiative commemorating the 250th anniversary of American independence; Sekoia suggests the target was invitation-themed spear-phishing around a high-profile national event. `theowo[.]club` proxied Raffles London at The OWO, a luxury hotel inside the old War Office building, a short walk from the Ministry of Defence and 10 Downing Street — and, per open-source reporting, Ukrainian President Volodymyr Zelensky's accommodation during an October 14 visit.

The third was the broadest: between August 27 and September 3, attackers modified the tracker file served by Plerdy, a Ukrainian web analytics service loaded by thousands of sites, most of them Ukrainian. For one week, every visitor to those sites loaded both the legitimate tracker and the fingerprinting script. Sekoia notes the overlap with defence-sector, special-forces and military-equipment sites, but says it cannot determine whether the goal was targeted collection or simply casting the widest possible net over unpatched phones.

A fingerprint built to waste an analyst's context window

The fingerprinting script is a curiosity in its own right. It runs 61 collectors that assemble 394 JSON fields — canvas, audio and WebGL hashes, font and sensor checks, Apple-specific feature probes, even USB, NFC and Bluetooth availability — then posts the result to a server that returns exploit code as the HTTP response body.

Almost none of it matters operationally. Only three fields can block delivery: implausible screen dimensions and a zero `maxTouchPoints` value, i.e. a device that isn't a phone. The rest is collected and seemingly unused.

The file itself is padded: the payload is appended to a 2.3-megabyte minified copy of AngularJS, which accounts for roughly 98 percent of its size. Sekoia's reading is that the padding is meant to defeat automated analysis by large language models by blowing past their context windows — or, failing that, to make the script look like an ordinary library at a glance. Either way, it is a technique aimed squarely at the tools defenders now use to triage JavaScript.

What the exploit chains take

The delivery server picks a chain based on the reported platform and browser version. Sekoia retrieved three.

Class A targets iOS 16.7 and chains an RCE (CVE-2025-43529) with a pointer-authentication bypass (CVE-2024-27834), then sweeps process IDs, opens each app's container and reassembles `Cookies.binarycookies` files. Cookies are exfiltrated to a hardcoded endpoint. Notably, the sample carries dead code from older exploits — an `AccessCase` use-after-free and an SBFX overflow — suggesting a kit reused rather than rebuilt.

Class B targets iOS 18.5 and is the full DarkSword chain: the same initial RCE, a different PAC bypass (CVE-2026-20700), then two sandbox escapes (CVE-2025-14174 and CVE-2025-43510) and a kernel read/write primitive (CVE-2025-43520). The post-exploitation payload is a phone harvest: SMS and iMessage databases, Mail indexes, voicemail, WhatsApp and Telegram databases, Keychain entries, Wi-Fi pre-shared keys, contacts, call history, calendars, notes, Safari history and cookies, app-usage timeline, location caches, Health data, the photo library and iCloud Drive.

Class C targets Android Chrome 139 through 145, skipping version 143 for reasons Sekoia could not establish. It exploits CVE-2026-3910 for renderer code execution, then CVE-2025-27038 in the Adreno GPU driver to escape the browser sandbox, and drops a payload the researchers named AndroSnitch — 16 functions whose only job is to read Chrome's Cookies, Login Data and History files plus the system Wi-Fi configuration. It aborts if the device is a Galaxy S25 Ultra.

None of the chains establishes persistence. They steal and leave, which fits an intelligence-collection objective: stolen session cookies let an operator reuse authenticated sessions, including webmail, without needing malware resident on the device.

The attribution trail

Sekoia's case rests on infrastructure overlap with a 2025 watering-hole campaign attributed to APT29, on the victim profile (concentrated in Ukraine, the US and Europe, with a Czech far-right party site in the mix), and on Google TAG's confirmation that the framework resembles APT29's 2024 operation against Mongolian government sites. That earlier campaign used a hardcoded target filter; this one does not — it takes whatever cookies it can reach.

Google TAG has said the 2024 exploits matched those used by commercial surveillance vendors, and that it was unclear how APT29 obtained them. Sekoia's analysis leans the same way: the delivery host only offers the Class A chain to iOS 16.7, though the exploit works from 16.0 to 17.4 — the kind of mismatch you get from reusing someone else's packaged kit without retuning it.

The strategic takeaway Sekoia draws is about supply, not attribution. Packaged, resold mobile exploit chains lower the cost of entry for state groups, and reuse of commercial kits is likely to become more common — which means the practical defence stays where it has always been: keep the phone current.

Sources