A recent campaign by the Russian-linked hacking group APT29—also known as Midnight Blizzard or Cozy Bear—has been hijacking both genuine and lookalike websites to silently compromise out-of-date iPhones and Android phones. The attacks were detected in mid-October 2026 and affect visitors in the United States, Ukraine, the Czech Republic, and Bulgaria.
The attack chain takes three forms: inserting malicious code into hacked websites, spinning up counterfeit sites that imitate legitimate ones, and a brief but wide-reach compromise of a Ukrainian SEO analytics service. In each case, the malicious JavaScript checks the visitor’s device and delivers an exploit if the device has not been patched.
How Attackers Sneak In
One route saw attackers adding a few lines of JavaScript into the template of a Ukrainian gas production company’s web page, which then pulled in remote scripts from attacker-controlled servers. Other compromised real sites included a U.S. chemical trade association, a far-right European political party, and a site tied to Bulgarian military content.
When direct penetration failed, the hackers created lookalike domains—such as america250[.]holiday and theowo[.]club—that mirrored legitimate sites (including one tied to a UK hotel near sensitive government locations). Visitors saw the authentic content, but hidden code ran in the background.
Perhaps most broadly damaging was a breach at Plerdy, a Ukrainian SEO tracker used by thousands of sites. For approximately one week from August 27 to September 3, 2026, attackers modified Plerdy’s tracker file so that the malicious script was loaded by all client sites using the service. Many of those sites had connections to defense and military sectors.
Exploits & Exfiltration
The hidden script, dubbed “UltimateFingerprinter,” was embedded inside a near-full-size copy of the AngularJS library (roughly 2.3 MB, with over 98 % of the file being the legitimate framework). It gathers nearly 400 data points through over 60 checks. Many of those checks are tailored to detect devices that automated scanning tools will ignore—such as very large screens or no touch support—allowing the malicious payload to evade detection.
Three exploit chains were identified—classified A, B, and C:
- Class A targets iOS 16.7 to steal cookies, exploiting two vulnerabilities (CVE-2025-43529, CVE-2024-27834). It prevents repeat infections using marker cookies.
- Class B is more severe, attacking iOS 18.5 using multiple patched vulnerabilities (including CVE-2025-43529, CVE-2026-20700, and others). It steals messages from WhatsApp and Telegram, contacts, call history, photos, Keychain and iCloud Drive content.
- Class C targets Android devices using Chrome versions 139-145 (excluding 143), leveraging vulnerabilities like CVE-2026-3910 (graphics driver flaw) and CVE-2025-27038. Its payload—named AndroSnitch—steals Chrome cookies, saved logins, browsing history, Wi-Fi credentials. It self-disables upon finding devices like Samsung Galaxy S25 Ultra.
All stolen data is exfiltrated to ad.starx-net[.]com. None of the payloads establishes long-term access; rather, they enable rapid intelligence gathering and credential reuse based on session cookies.
How to Defend Yourself
The researchers behind the discovery strongly advise updating iOS and Chrome immediately, and replacing phones no longer receiving updates. Organizations should audit all third-party scripts they load and check server logs for any signs of communication with known malicious domains tied to this campaign.
Indicators of compromise (IoCs) include delivery domains like static.flux-telemetry[.]com and edge-ord.clouds-stacks[.]com, exfiltration domains such as ad.starx-net[.]com, and counterfeit sites like theowo[.]club and america250[.]holiday. File hashes for various stages of the exploits are also available for threat hunters.
This campaign adds to a string of watering-hole style attacks in recent years attributed to the same group, including ones tied to Mongolian government websites and other recent attempts that covertly deliver surveillance malware through vulnerable devices.
What it means: These attacks illustrate how even patched platforms can be compromised by forgotten or unpatched endpoints still in use, especially when attackers leverage trusted infrastructure or third-party services. The blurring of lines between legitimate and fake sites makes detection harder. Moving forward, defenders must assume exposure through dependencies like analytics tools and demand supply chain transparency. Threat actors’ increasing reuse of commercial exploit kits only escalates risk—patch early, audit often, and monitor third-party script activity.
