Watering holes served known-flaw exploits to out-of-date phones; Sekoia assesses with moderate to high confidence it was APT29

Sekoia said on Nov. 4 that exploit chains for out-of-date iPhones and Android phones ran on compromised sites, mostly Ukrainian, and on lookalike sites. Your exposure is phones outside your patch program and iPhones capped at iOS 16.7.16, which we cannot show are safe; patching does not undo stolen sessions.

What happened

Sekoia assesses with moderate to high confidence that APT29, "or at least one of its subgroups," ran the campaign. Its basis includes a private report, cited by a partner, that we cannot check. Sekoia says visitors arrived through injected code on legitimate sites, reverse-proxy lookalikes and the analytics tracker Plerdy.

Plerdy said on Oct. 29 that an attacker used stolen administrator credentials, its script carried unauthorized code from Aug. 27 to Sept. 3, and client contact data was accessed. It "found no evidence" visitor data was taken and named no actor. Sekoia could not retrieve the Plerdy-path script. From a matching filename, it assesses with moderate to high confidence that it was the campaign's fingerprinting script; Sekoia does not say which chain, if any, reached Plerdy's visitors. Sekoia gives both hundreds and thousands of exposed sites.

Sekoia says no chain works on a fully updated device.

Who is affected

Sekoia describes a particular focus on Ukraine and, on directly compromised sites, a focus on Ukraine and the United States; Plerdy's sites are a large majority Ukrainian. Sekoia describes two US sites: a compromised US chemical-industry trade association (unnamed) and a lookalike of America250. Sekoia gives no count of infected phones and names no infected device or US company. Our analysis: most US companies are probably not this campaign's intended target, though Sekoia says it is unclear whether the Plerdy phase was selective; per Sekoia, packaged chains lower the cost of phone exploitation.

What to do now

• Mobile team, this week: pull from MDM every phone below the fix builds above. Block iPhone 8, 8 Plus and X from corporate apps until you replace them: they stop at iOS 16.7.16, Apple lists no iOS 16 fix for CVE-2025-43529, and Sekoia gave no test on that build. They also lack Pointer Authentication, which CVE-2024-27834 bypasses, so in our analysis its fix may not help. Update them to 16.7.16 anyway, and every other phone.
• Identity team, today: for any vulnerable phone that may have visited an affected site, revoke sessions and rotate saved passwords, tokens and shared Wi-Fi keys. Our analysis: revoke now, but update the phone before rotating, or rotated credentials can be taken again. If a phone cannot be updated today, block it and rotate anyway. Sekoia says stolen data may allow session reuse, including webmail; the payloads establish no persistence. Our inference: a reboot likely ends the infection until another visit, so a later device check may find nothing.
• SOC, this week: search DNS and proxy logs from April 2026 (Aug. 27 to Sept. 3 for Plerdy) for these Sekoia-published hosts: static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, adsprism-stat[.]com, ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com, ad.starx-net[.]com, theowo[.]club, america250[.]holiday. Sekoia withholds several indicators, so a clean hunt clears no one; logs miss phones on cellular or home Wi-Fi. Sekoia says theowo[.]club is now offline and edge-ord.clouds-stacks[.]com was when it tried to retrieve the script; it is assessing options to disrupt the infrastructure. Block all ten.
• IT, this month: require a minimum OS for phones reaching corporate apps with an Intune app protection policy under Conditional Access, with the iOS floor above 16.7.16. Microsoft says this needs device registration through a broker app, not enrollment. It also says app protection now requires iOS 18; the pages we read do not say what happens below that, so test a capped iPhone first. In our view, the mobile block reaches enrolled phones only until the policy is in place, and the policy cannot stop stolen-cookie replay.
• Web team, this week: check whether your site or vendors load Plerdy; Plerdy says clients need not change code. Expect phishing at exposed contacts.

Sources and updates

• Sekoia, Poisoned Source.
• Plerdy, security incident notice.
• Apple, iOS 18.7.3 security content.
• Apple, iOS 16.7.8 security content.
• Apple, iOS 26.3 security content.
• Apple, iOS 18.7.2 security content.
• GTIG, The Proliferation of DarkSword.
• Chrome Releases, Chrome for Android update (March 12, 2026).
• Android Security Bulletin, August 2025.
• CISA, KEV alert (Nov. 4, 2026).
• CISA, Known Exploited Vulnerabilities catalog, CVE-2025-43529.
• Microsoft, Manage device operating system versions with Intune.
• Apple Platform Security, Operating system integrity.
• Apple, iOS 26.2 security content.
• Apple, iOS 17.5 security content.
• Apple, security releases index.
• Chrome Releases, desktop stable update (March 12, 2026).
• Microsoft, Conditional Access grant controls.
• Microsoft, What's new in Intune.
• Microsoft, App protection policies overview.