Overview
- Researchers at Sekoia published detailed findings on November 4, 2026 that link the operation to Russia‑linked APT29 with moderate-to-high confidence and describe a large-scale watering‑hole effort.
- The campaign reached victims by three routes: injected JavaScript on legitimate sites, lookalike proxy domains, and a week‑long compromise of Ukrainian analytics provider Plerdy that ran from August 27 to September 3, 2026.
- The initial code fingerprinted each visitor’s device and browser and a command‑and‑control server then pushed platform‑specific n-day exploit chains, where n-day means already disclosed and patched vulnerabilities.
- Sekoia identified multiple targeted CVEs used in the chains — including iOS and Chrome flaws tied to the DarkSword kit — and said the payloads harvested browser cookies, messaging databases, keychain items, photos, location data, and saved Wi‑Fi credentials.
- All exploited flaws have been patched by Apple and Google, none of the payloads established persistence, and immediate risk is reduced by applying updates, rebooting devices and avoiding known compromised or lookalike sites while defenders monitor web supply‑chain tags.