Skip to content
audiotale.net
Sign in
NewsNews

CVE-2025-43529 and DarkSword: APT29 watering holes hit unpatched iPhones and Android

Sekoia says a Russia-linked group used only patched n-day bugs, from CVE-2025-43529 to CVE-2026-3910, against phones via cloned and hijacked websites.

audiotale.net team

· 7 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. The three exploit chains
  5. Background
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Security firm Sekoia says a Russia-linked espionage group has been infecting phones through websites it compromised or cloned, using exploit chains for iPhone and Android bugs that were all patched months or years ago. The report, published on 4 November 2026, names CVE-2025-43529, CVE-2026-20700 and CVE-2026-3910 among the flaws abused, and stresses one point that matters for everyone: every vulnerability in the campaign is an "n-day", so a phone that is fully up to date is not exposed to these chains. Sekoia assesses with "moderate to high confidence" that the actor is APT29, widely attributed to Russia's Foreign Intelligence Service (SVR). That attribution is the researchers' judgement, not a government finding.

Key points

  • Sekoia's Threat Detection & Research team found the campaign in mid-October 2026 and published its report on 4 November 2026; it covers sites in the US, Ukraine, the Czech Republic and Bulgaria.
  • All three exploit chains use already-patched flaws: two target iPhones (iOS 16.7 and iOS 18.5) and one targets Android Chrome 139 to 145 (except 143), per Sekoia.
  • One chain is DarkSword, an iOS exploit kit first described by Google's Threat Intelligence Group (GTIG) on 18 March 2026; Apple fixed everything it uses by iOS 26.3.
  • Sekoia says a Ukrainian analytics service, Plerdy, was compromised between 27 August and 3 September 2026, exposing visitors to thousands of mostly Ukrainian sites.
  • Updating iOS to 26.3 or later, and Chrome and Android to current versions, closes the specific holes named.

What to do

  • iPhone and iPad: update to the latest iOS or iPadOS. Apple fixed the dyld bug CVE-2026-20700 in iOS 26.3. The WebKit bug CVE-2025-43529 is listed as fixed in iOS 18.7.3 and iOS 26.2, and the kernel bug CVE-2025-43520 and sandbox bug CVE-2025-43510 in iOS 18.7.2 and 26.1 (all per the National Vulnerability Database, NVD). If you cannot update, GTIG recommends turning on Lockdown Mode.
  • Older iPhones still on iOS 16.7: Sekoia's first chain targets exactly that version. NVD's entry for CVE-2025-43529 lists fixes in iOS 18.7.3 and 26.2 and does not list an iOS 16 release. We could not confirm whether iOS 16 devices received a fix, so check Apple's security notes for your model and replace a phone that cannot run a patched version.
  • Android: the Chrome bug CVE-2026-3910 is fixed in Chrome 146.0.7680.75 and later (NVD). The GPU-driver bug CVE-2025-27038 was patched in Android's August 2025 update, according to SecurityWeek. Install the current Chrome and your latest monthly Android security update.
  • Check your exposure: if your phone runs a current OS and browser, these chains do not work on it. If you manage a fleet, look for devices stuck on old iOS or Chrome versions, and use Sekoia's indicators of compromise, which it shares with national CERTs and law enforcement on request.
  • Site owners: audit third-party scripts. Two of the three infection routes ran through a site's own pages or a tracking script it loaded.

What happened

Sekoia says its team first spotted a malicious JavaScript inclusion on the website of a Ukrainian gas production company, then followed it to more sites. The company describes three ways visitors were sent to the attackers' exploit server.

The first was direct tampering: a script tag added to a site's page template, or code appended to an existing JavaScript file. Sekoia lists a US chemical industry trade association, a Bulgarian military-related site and a political party's site in Europe among the compromised sites, and says an Australian medical clinic also appeared, which complicates any single theory about targeting.

The second was a lookalike. The attackers registered domains that acted as reverse proxies for real sites and injected the script into each page on the fly. Sekoia found two: america250[.]holiday, which proxied america250.org (the official site marking the 250th anniversary of American independence), and theowo[.]club, which proxied the website of Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street. Sekoia says the domains were created on 19 May and 18 June 2026 respectively, and suggests the choices may point to spear-phishing with event or invitation themes aimed at diplomatic visitors. That is the researchers' inference, and they say they lack visibility into the actual targeting.

The third was a supply-chain compromise. Between 27 August and 3 September 2026 the attackers altered a script served by Plerdy, a Ukrainian web analytics tracker loaded by thousands of sites, most of them Ukrainian, including defence and military-recruitment sites. Sekoia could not retrieve the second-stage script from that route because the server was offline, but matched its file name to the one served by the other routes.

Whichever route brought a visitor in, the same script ran. Sekoia calls it UltimateFingerprinter: it gathers 394 fields through 61 collectors, then sends them to a server that decides whether to answer with exploit code. In practice the check is crude. Only an implausible screen size or a device with no touch points blocks delivery, so Sekoia says the fingerprint barely affected who got attacked. The script was hidden inside a 2.3 MB copy of the AngularJS library, where about 98% of the file was dead code. Sekoia suggests that may be meant to slow analysis, including analysis by AI models with limited context windows.

The three exploit chains

Sekoia recovered three complete chains by posing as different browsers.

Chain Target CVEs What it steals
A iOS 16.7 (works on 16.0 to 17.4) CVE-2025-43529, CVE-2024-27834 Cookies
B iOS 18.5 CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520 Full device data
C Android Chrome 139 to 145, not 143 CVE-2026-3910, CVE-2025-27038 Chrome cookies, logins, history, saved Wi-Fi passwords

Chain B is DarkSword. After the exploit gets code running, according to Sekoia's analysis, its payload collects SMS and iMessage databases, Mail indexes, WhatsApp and Telegram databases, Keychain passwords and tokens, call history, contacts, notes, Safari history and cookies, location caches, health data, photos and iCloud Drive files. Chain C finishes with a payload Sekoia names AndroSnitch and skips Samsung Galaxy S25 Ultra phones (model SM-S938B). None of the payloads set up persistence, so the harvest happens in one go, and the cookies can let an attacker reuse logged-in sessions, including webmail.

Background

DarkSword is not new. GTIG reported on 18 March 2026 that it chains six vulnerabilities, supports iOS 18.4 through 18.7, and had been used since at least November 2025 by several commercial surveillance vendors and suspected state-backed actors against targets in Saudi Arabia, Turkey, Malaysia and Ukraine. GTIG said it reported the flaws to Apple in late 2025 and that all were patched by iOS 26.3. It also said UNC6353, a suspected Russian espionage group, had added DarkSword to its watering-hole campaigns. Sekoia says a copy of the kit was uploaded to VirusTotal in September 2026, and that chain A reimplements DarkSword's WebKit exploit rather than copying the file.

The attribution rests on overlaps. Sekoia says Google's Threat Analysis Group told it the framework resembles a 2024 APT29 watering hole against Mongolian government websites that also stole cookies. It adds that the attackers' infrastructure is spread across several hosting providers, as in earlier APT29 activity, and that one compromised site carried leftovers matching a private report on a 2025 APT29 campaign. There is a caveat in the report itself: those leftovers could mean the operator forgot to clean up, or reused old components by mistake. The report also says Ukraine was a focus of the victims.

What it means

For ordinary users the lesson is the one security teams repeat: n-days are cheap for attackers and useless against patched phones. Sekoia argues that packaged exploit kits make advanced mobile attacks cheaper, and expects state-sponsored groups to reuse commercial surveillance exploits more often. That is its forecast, not an established trend.

For organisations, the supply-chain route is the harder problem. A tracking or analytics script runs with the full privileges of the page that loads it, so one compromised vendor reached thousands of sites in a week. Subresource integrity does not help with a script that is meant to change, but content security policies, vendor reviews and monitoring for unexpected script changes can.

For readers outside the targeted groups, the practical risk is small but real: the Plerdy route was described by Sekoia as possibly indiscriminate, and the attackers used no zero-days, so anyone visiting an affected site on a phone running an old OS was a potential victim. Our own coverage of Chrome's latest security release is a reminder that browser updates arrive often, and phones that skip them stay exposed.

What we don't know yet

  • How many devices were infected. Sekoia does not give a victim count and is working with national CERTs on victim identification.
  • Who sold or supplied the exploits. Sekoia's analysis supports a third-party origin, and Google TAG told it the origin of the 2024 exploits was uncertain.
  • Why Chrome 143 and Galaxy S25 Ultra phones were excluded. Sekoia says the reasons remain unclear.
  • Whether the SVR attribution holds. Sekoia gives moderate to high confidence; no government has confirmed it in the sources we read.
  • Whether iPhones stuck on iOS 16.7 have a fix for CVE-2025-43529 (see above).

What to watch next

Watch for Apple, Google or CERT-UA statements on victims, for takedowns of the delivery domains Sekoia is trying to disrupt, and for Plerdy's own account of how its script was altered. We have not seen a statement from Plerdy in the sources we checked.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next