Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-04
APT29-linked watering hole uses n-day iOS and Chrome chains; CISA lists CVE-2024-27834; updated devices resist
Defender actions
- Move every managed iPhone and iPad to the newest iOS available for its model and every managed Android phone to Chrome 146 or later and the OEM patch level that fixes CVE-2025-27038, and list the devices that cannot go past iOS 16.7.x (iPhone 8, 8 Plus, X, iPad 5th generation, iPad Pro 9.7-inch and 12.9-inch 1st generation per Apple), because Sekoia's chains do not work against fully updated devices and CISA lists all eight flaws they deliver as exploited.
Analysis
CISA added CVE-2024-27834, a WebKit flaw that lets an attacker with arbitrary read and write capability bypass Pointer Authentication and that Apple fixed on 2024-05-13, to its Known Exploited Vulnerabilities catalog on 2026-11-04, and names no victim or method (CISA KEV, 2026-11-04; Apple, 2024-05-13; Apple, 2024-05-13). The same day Sekoia reported a watering-hole campaign that it assesses with moderate to high confidence to be APT29 or one of its subgroups and in which that flaw is the pointer-authentication bypass of an iOS chain (Sekoia, 2026-11-04); the link between the listing and the campaign is the date alone. Sekoia retrieved three chains from the delivery host, which profiles the visitor and serves a platform-specific exploit without user interaction: an iOS 16.7 chain (CVE-2025-43529, then CVE-2024-27834) that steals the cookies of running apps; a DarkSword-based iOS chain that Sekoia's table labels iOS 18.5 (CVE-2025-43529 with CVE-2026-20700, then CVE-2025-14174 with CVE-2025-43510, then CVE-2025-43520) that harvests the phone; and an Android chain for Chrome 139 to 145 except 143 (CVE-2026-3910, then the Adreno driver flaw CVE-2025-27038) that takes Chrome cookies, saved logins, history and Wi-Fi configuration (Sekoia, 2026-11-04). The payloads exfiltrate data without establishing persistence, and Sekoia says none of the chains contains a zero-day or works against fully updated devices (Sekoia, 2026-11-04).
Delivery used JavaScript injected into legitimate sites, among them a Ukrainian gas producer, a US chemical-industry trade association, a Bulgarian military-related site and an Australian clinic; reverse-proxy clones of high-profile sites; and a one-week compromise, 27 August to 3 September 2026, of the Plerdy SEO tracker script, which Sekoia says exposed hundreds or thousands of sites, mostly Ukrainian (Sekoia, 2026-11-04). Sekoia names no Swiss victim, counts no infected devices and says it is working with national CERTs on victim identification.
Fixes: iOS 26.2 and 18.7.3 close CVE-2025-43529 and CVE-2025-14174, iOS 26.1 and 18.7.2 close CVE-2025-43510 and CVE-2025-43520, iOS 26.3 closes CVE-2026-20700, and Chrome 146 closes CVE-2026-3910 (Apple, 2025-12-12; Google Threat Intelligence Group, 2026-03-18; Chrome Releases, 2026-03-12).
Cited evidence
None of them contain zero-days or work against fully updated devices.
These elements lead us to assess with moderate to high confidence that the intrusion set behind this watering hole campaign is APT29, or at least one of its subgroups.
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Sources8
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.