Russian APT29 Launches Large-Scale Watering Hole Attacks Targeting iOS and Android Users
State-sponsored actors leverage compromised websites and analytics supply chains to deploy advanced mobile exploit kits.
1Sophisticated Watering Hole Campaign
The Russia-linked group APT29, also known as Midnight Blizzard, launched a widespread watering hole campaign in mid-October 2026. By compromising high-profile websites and a Ukrainian analytics service, attackers deliver malicious payloads to iOS and Android users. This operation demonstrates a strategic shift toward exploiting unpatched mobile devices for intelligence gathering.
2Diverse Infection Vectors Used
Attackers utilize three primary methods: injecting malicious JavaScript into hacked websites, creating fake domains mimicking legitimate services, and compromising the Plerdy web analytics tracker. The Plerdy supply-chain attack was particularly impactful, as the script was loaded by thousands of websites, predominantly in Ukraine, between August 27 and September 3, 2026.
3Strategic Targeting of High-Value Sites
Compromised platforms include military recruitment sites, special forces portals, and a major U.S. chemical industry association. Researchers noted a fake website impersonating the Raffles London hotel, located near the UK Ministry of Defence. This site may have targeted diplomatic delegations, especially given President Zelensky’s reported stay there on October 14.
4Advanced Profiling and Data Collection
A custom profiling script, dubbed UltimateFingerprinter, runs 61 collectors to build 394 distinct data fields from visitor browsers. While the attackers gather massive amounts of telemetry, most data appears irrelevant to the final exploit delivery. This complexity, including a 2.3 MB minified AngularJS library, likely aims to evade automated security analysis.
5Platform-Specific Exploit Chains
The delivery infrastructure serves three distinct exploit classes. Class A targets iOS 16.7 to steal cookies, while Class B exploits iOS 18.5 for full device data extraction. Android users running Chrome versions 139 to 145 face exploits stealing Wi-Fi passwords and browser cookies, though the malware specifically avoids Samsung Galaxy S25 Ultra devices.
6Reuse of Commercial Surveillance Tools
The operation confirms the state-sponsored adoption of commercial mobile exploit frameworks like DarkSword. By utilizing packaged N-day exploits, APT29 lowers the technical threshold and costs required for advanced mobile surveillance. This trend mirrors other recent campaigns, such as DeadTag, which also weaponize expired analytics tags to silently compromise mobile browser sessions.
7Indiscriminate vs. Targeted Objectives
It remains unclear if the campaign seeks to compromise as many unpatched devices as possible or specifically targets high-value individuals. The attackers exfiltrate data indiscriminately before selectively identifying information of interest. This methodology allows the group to maintain a broad reach while focusing resources on strategically important targets during the war.
8Implications for Mobile Security
These attacks highlight the danger of browser-based exploits that require no user interaction to trigger. Because the kits attack the browser itself, simply visiting a compromised page can lead to full device spyware installation. Users must remain vigilant, as even legitimate-looking websites can now serve as silent gateways for sophisticated state-sponsored surveillance.