Overview
- Sekoia published its analysis on Nov. 4 after discovering malicious JavaScript on a Ukrainian gas company in mid-October and found a large-scale watering‑hole effort that served platform-specific n‑day exploit chains to visitors.
- The attackers reached targets by injecting JavaScript into legitimate sites, running lookalike reverse‑proxy domains, and briefly compromising the Ukrainian analytics provider Plerdy from August 27 to September 3 to load the profiling code on thousands of sites.
- Researchers recovered three complete exploit chains: two for iOS that reuse the DarkSword family and multiple CVEs (including CVE-2025-43529 and CVE-2024-27834 for older iOS, plus CVE-2026-20700 and others for iOS 18.5) and one for Android that chains CVE-2026-3910 (Chrome) with CVE-2025-27038 (Adreno) to deploy an AndroSnitch payload.
- Payloads exfiltrated browser cookies, messaging and mail databases, Keychain credentials, photos, location data and saved Wi‑Fi credentials to ad.starx-net[.]com:8881/telemetry/v12, and none of the delivered implants established persistence so a reboot clears activity until re‑exposure.
- Vendors had already patched the targeted flaws so updating OS and browsers is the key mitigation, CERTs and agencies are coordinating victim identification and takedown, and Sekoia warns reuse of commercial exploit kits lowers the cost and scale of future mobile targeting.