APT29 Mobile Watering Hole: Tracker Hijack, Three Exploit Chains and Defences

Sekoia’s Threat Detection and Research team published an analysis on 4 November 2026 of an APT29 mobile watering hole that ran against iPhone and Android users. The chains rely on n-day flaws that vendors had already fixed, so a fully updated device is outside their reach. Sekoia assesses APT29 with moderate to high confidence and says it found the campaign in mid-October 2026.

This post follows the attack in order, from the page a victim opens to the data that leaves the phone, and ends with what a defender can check this week. Everything below comes from Sekoia’s report, the CVE records and CISA’s catalogue unless it is marked as our advice.

How Did Victims Reach the Exploit Server?

Sekoia describes three infection vectors. First, the operators injected JavaScript into legitimate sites, either in page templates or at the end of an existing script file. Sekoia lists sites from the energy sector, an industry trade association, a political party and a defence-related organisation.

Second, they registered lookalike domains that reverse-proxied two real sites, one for a US commemorative initiative and one for a London luxury hotel. The proxy rewrote the HTML on the fly and added a script at the bottom of each page. Sekoia suggests these were meant for invitation-themed spear phishing of diplomatic or high-profile guests.

Third, a supply chain compromise changed the main JavaScript file of a Ukrainian SEO and web-analytics tracker for one week, from 27 August to 3 September 2026. Sekoia says the tracker is loaded by thousands of mostly Ukrainian sites. Its introduction says hundreds of legitimate sites were exposed, and the report does not settle the difference.

What Does the Fingerprinting Script Collect, and What Does It Ignore?

The loader is a custom JavaScript file of about 2.3 MB. Sekoia says roughly 98 percent of it is minified AngularJS used as dead code, probably to hinder analysis or to blend in. The real logic runs 61 collectors that build 394 JSON fields covering canvas, audio, WebGL, fonts, sensors, battery and Apple-specific values.

The script posts these fields to a second endpoint, and the response is JavaScript the page then runs. Only three values can stop delivery: an implausible screen width, an implausible screen height, or a maximum touch point count of zero. In those cases the server answers with an empty page.

Sekoia says the purpose of the heavy fingerprinting remains unclear, because it found no sign that the data shaped exploit choice beyond those checks. The server picks a chain from the device’s operating system and browser version. In our reading, a browser that reports zero touch points, as many desktop browsers do, receives nothing.

Which Three Exploit Chains Does It Deliver?

Sekoia groups the delivery into classes A, B and C. The table lists the CVEs Sekoia names, with the fixed releases taken from the CVE records. Sekoia gives no fixed build numbers itself.

Class A and class B drop a marker cookie as a replay guard. A date calculation error makes it last about one minute instead of one day, so it blocks only very fast re-infection. Class C has no such check.

What Does Each Chain Take From the Phone?

Class A uses a renderer code execution bug and a pointer authentication bypass, then reads cookie files from the app containers. Sekoia says it works on iOS 16.7 and, by its estimate, from iOS 16.0 to 17.4. The mismatch between that range and the exploited versions could indicate that the operators reused exploit code from a third party without fully adapting it.

Class B is the DarkSword chain, delivered in three staged downloads. Stage one gives renderer code execution with a pointer authentication bypass, stage two escapes the sandbox, and stage three gains kernel read and write to launch a harvester.

The harvester collects messages from SMS, iMessage, WhatsApp and Telegram, plus mail indexes, keychain items, account databases and Wi-Fi keys. It also takes contacts, call history, notes, browser history, cookies, location caches, Health data, photos and iCloud Drive files. It does not set up persistence.

Class C uses a V8 bug for code execution inside the Chrome sandbox, then an Adreno GPU driver bug to leave it. A second stage, which Sekoia calls AndroSnitch, collects Chrome cookies, saved logins and history plus Wi-Fi configuration, and uploads them with libcurl. The chain stops on one Samsung flagship model, and Sekoia could not explain why Chrome 143 is excluded.

How Firm Is the APT29 Attribution?

Sekoia gives moderate to high confidence. Its reasons are technical overlaps, operational patterns, a focus on Ukraine, Europe and the US, infrastructure spread over several hosting providers and past APT29 interest in European political parties. A CERT partner also reported traces on a compromised site that match a separate 2025 APT29 watering hole, which Sekoia says may be leftover artefacts or a mistake.

Google’s Threat Analysis Group reported in August 2024 a watering hole on Mongolian government sites that it linked to APT29 with moderate confidence. It used n-day exploits for iOS and Chrome that matched ones from commercial spyware vendors. Sekoia says the framework used in this campaign resembles that campaign. The 2024 chain stole cookies for a hardcoded list of sites, while this one takes cookies from any site the victim visits.

How APT29 obtains these exploits is not known. Both reports describe code that matches commercial spyware tooling, and Sekoia calls DarkSword a suspected commercial surveillance vendor kit uploaded to VirusTotal in September 2026. Our APT29 profile covers the group’s history, and the mercenary spyware entry explains the vendor side.

What Should Defenders Do This Week?

Sekoia’s own guidance is short: a device on an up-to-date operating system is safe from these chains, and it is working with the CERTs of affected countries. The steps below are our advice, built from the report’s behaviour.

1. Check the OS and browser version of every phone that touches sensitive accounts. The records list iOS 26.3 as the release that fixes every iOS flaw named for classes A and B. For the V8 bug in class C, they list Chrome 146.0.7680.75.
2. Retire or isolate devices that cannot move to a fixed iOS release. Apple’s record for CVE-2025-43529 names iOS 18.7.3 and 26.2, so we would treat a phone that cannot run iOS 18 as exposed to that bug.
3. Consider Lockdown Mode for high-risk users. Google’s 2024 report said the earlier iOS exploit did not work with it, but Sekoia does not say whether that holds for these chains.
4. If your site loads a third-party tracker, pin it with Subresource Integrity or host a reviewed copy, and alert when its file hash changes. A hash alert would show a change like the one-week tracker edit.
5. Hunt for a 2 MB script on a page that normally carries a small analytics file, and for a large JSON POST from a mobile browser to an unknown host.
6. Watch for newly registered domains that proxy your own event or hotel pages, and report them for takedown.
7. After any suspected visit, revoke browser sessions and Wi-Fi passwords, because the chains steal cookies and saved network keys.

For the technique pages, see Drive-by Compromise and Compromise Software Supply Chain. The stolen cookies matter because a session cookie can let an attacker skip a login. An earlier case on older iPhones is in our iOS 18.7.11 post.

What Is Still Unclear?

Sekoia could not retrieve the script from the load-balancing delivery domain, so it assesses with moderate to high confidence that it matches the fingerprinter seen elsewhere. It does not know whether the tracker compromise targeted specific sites or was indiscriminate. It also calls the link between AndroSnitch and an earlier Android sample unconfirmed, and it withholds some indicators, which it shares with national CERTs and law enforcement under TLP:AMBER.