A Russia-linked hacking group ran a watering-hole campaign that infected unpatched iPhones and Android phones through compromised websites and a hijacked analytics script, researchers say — fully updated phones were safe.

Sekoia Threat Detection and Research, which detected the campaign in mid-October and reported on 4 November, links it to APT29 — also known as Cozy Bear — at moderate to high confidence. That is an assessment, not proof; no victim count has been disclosed.

Three ways in

Visitors were reached three ways: malicious JavaScript injected into compromised legitimate websites, lookalike domains, and a supply-chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics service. Its tracking script served attacker code from 27 August to 3 September 2026, reaching thousands of mostly Ukrainian sites — exposure, not confirmed infections.

A profiling script collected browser and device details, then served a matching exploit chain with no user interaction. Every flaw had already been patched, so only unpatched devices were at risk.

Three exploit chains

On iOS 16.7, CVE-2025-43529 (WebKit remote code execution) and CVE-2024-27834 (Pointer Authentication bypass) ran cookie-stealing JavaScript malware. On iOS 18.5, the DarkSword chain — CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 — could steal messages, mail, chat stores, iCloud Keychain, Wi-Fi passwords, contacts, Safari data, photos and health records. DarkSword is a commercial iOS exploit kit Google has linked to customers of Turkish vendor PARS Defense.

On Android, the Chrome chain — CVE-2026-3910 with CVE-2025-27038, a Qualcomm Adreno GPU driver flaw — gave remote code execution, a sandbox escape and privilege escalation, delivering a stealer called AndroSnitch for Chrome data and Wi-Fi passwords. The chain aborted on Samsung Galaxy S25 Ultra handsets, for unexplained reasons.

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities list on 4 November, with a federal patching deadline of 18 November 2026.

Sources: The Hacker News, APT29-linked hackers hijack web analytics to target iPhones and Androids, 5 November 2026; ICHI Global Five Minute Cyber Rundown, 5 November 2026; primary research: Sekoia Threat Detection and Research, "Poisoned Source", 4 November 2026.