Between late August and early September, attackers inserted malicious code into a Ukrainian analytics script used by thousands of websites, turning routine browsing into a mobile exploitation path. Yet every exploit relied on flaws Apple and Google had already patched, so the campaign's decisive weakness was not technical novelty but outdated software on exposed devices.
In this article
Why this matters
The campaign's significance lies in how it converted ordinary web browsing into an attack path. Malicious code placed on legitimate sites, cloned sites and a compromised Ukrainian web analytics service fingerprinted visitors' devices and attempted to exploit known browser and operating-system flaws. No application installation, configuration-profile approval, attachment or link click was required. The objective was collection rather than persistent access: passwords, messages, email, browser data, cookies, contacts, photographs, location history and data held by messaging applications including WhatsApp and Telegram (The Record).
That combination changes the defensive problem. The delivery footprint was broad, but the technical precondition was narrow: a vulnerable software version visiting a reachable delivery page. “Zero-click” described the interaction requirement, not an inability to defend. Fully updated devices were not vulnerable, and the campaign did not require a previously unknown flaw (The Record).
The failed assumption was that mobile endpoints could be treated as low-value because they rarely host enterprise data. In this operation, the handset was the collection point for authenticated sessions, personal communications, credentials and location data. A mobile compromise could therefore become a credential-compromise event requiring session revocation and token rotation, not merely an endpoint cleanup task.
What happened
Sekoia attributed the operation to APT29, also known as Cozy Bear and Midnight Blizzard, a Russian foreign-intelligence-linked espionage group. The Record described it as a group widely believed to operate on behalf of Russia's foreign intelligence service, the SVR (The Record). The investigation began after researchers found malicious code on the website of an unnamed Ukrainian gas production company. Related compromises were identified at a major U.S. chemical-industry trade association and a far-right European political party (The Record).
The operators also created fake versions of America250, an initiative commemorating the 250th anniversary of U.S. independence, and Raffles London at The OWO, a luxury hotel near several British government buildings. The clones displayed legitimate content while running code that identified visitors using vulnerable devices. Researchers suggested the America250 clone could lure victims with anniversary-event invitations, while the hotel clone could target diplomats and other high-profile guests (The Record).
The broadest channel was Plerdy, a Ukrainian web analytics service used by thousands of websites, most based in Ukraine. Between late August and early September, attackers inserted malicious code into a tracking script distributed through the service, potentially exposing visitors who browsed hundreds of websites, including sites associated with the Ukrainian military, special forces and manufacturers of drones and other military equipment. The script identified devices and software versions before attempting known flaws, functioning as reconnaissance and exploit selection rather than conventional analytics (The Record).
Three device-specific paths were used. On older iPhones running iOS 16, attackers targeted browser and application cookies, potentially enabling access to online accounts. A more advanced path against vulnerable iPhones running iOS 18.5 could extract messages, emails, passwords, contacts, photographs, location history and messaging-application data. On Android, exploits against older versions of Google Chrome targeted browsing data, cookies and saved Wi-Fi passwords (The Record).
| Claim | Status | Basis |
|---|---|---|
| The campaign used previously patched flaws and would not work against fully updated devices | Confirmed | Sekoia findings reported by The Record |
| Malicious code was inserted into the Plerdy tracking script between late August and early September | Confirmed | The Record's account of Sekoia's findings |
| Fake America250 and Raffles London sites served malicious code | Confirmed | The Record's account of Sekoia's findings |
| The operation was attributed to APT29 | Reported | Sekoia attribution, reported by The Record |
| The campaign targeted users in Ukraine, the United States and Europe | Reported | The Record's summary of Sekoia's findings |
| Ukrainian President Volodymyr Zelensky was targeted | Not established | Researchers found no evidence of targeting |
| The number of successfully compromised phones | Not established | Sekoia did not establish a victim count |
The role of DarkSword
The advanced iOS path relied on DarkSword, which The Record described as a suspected commercially developed surveillance tool capable of extracting large amounts of information from iPhones. Google Threat Intelligence Group independently identified DarkSword as a full-chain iOS exploit using six vulnerabilities, supporting iOS versions 18.4 through 18.7, and observed multiple commercial surveillance vendors and suspected state-sponsored actors using it against targets in Saudi Arabia, Turkey, Malaysia and Ukraine (Google Threat Intelligence Group).
GTIG reported the vulnerabilities to Apple in late 2025, and all were patched with the release of iOS 26.3, although most had been patched earlier. The chain deployed three final-stage malware families after successful compromise: GHOSTBLADE, GHOSTKNIFE and GHOSTSABER. GTIG also observed that UNC6353, a suspected Russian espionage group previously associated with the Coruna iOS exploit kit, had incorporated DarkSword into watering-hole campaigns (Google Threat Intelligence Group).
This chronology explains the apparent contradiction between “zero-click” and “n-day.” DarkSword was originally a zero-day chain, but once its vulnerabilities were patched, the chain remained useful against devices that had not been updated. The APT29 operation described by Sekoia used known flaws and would not work against fully updated devices. The commercial exploit chain therefore became a reusable commodity for actors operating against an unpatched population (The Record).
The limits of the evidence
The record establishes delivery infrastructure, exploit selection and intended collection scope. It does not establish the scale of successful compromise. Sekoia did not determine how many smartphones were compromised or how much information was obtained, and the company said it was working with computer emergency response teams in affected countries to identify potential victims and explore ways to disrupt the infrastructure (The Record).
Intent is also unresolved. Sekoia could not determine whether the operators were pursuing specific individuals or attempting to collect information from as many vulnerable devices as possible before identifying valuable targets. The selection of compromised industrial and political organizations, together with cloned prestige sites, suggests intelligence collection, but the record does not establish a named target list or a confirmed successful extraction from any specific individual (The Record).
The absence of persistence further complicates retrospective assessment. Unlike some spyware operations, these attacks were designed to extract information without maintaining long-term access. That collection-first design reduces the chance of detection through persistent implants and leaves fewer durable artifacts for investigators to discover. It also means the absence of a beacon is not evidence that a device was never exploited (The Record).
Defensive implications
The direct control is version currency. Patching iOS and Chrome removes the vulnerable condition the exploit chain requires. Google Threat Intelligence Group added domains involved in DarkSword delivery to Safe Browsing and urged users to update to the latest iOS version, recommending Lockdown Mode where updating was not possible (Google Threat Intelligence Group).
Organizations should also inventory mobile fleets, hunt for the compromised web infrastructure and exploit-delivery artifacts, and treat suspected mobile cookie or message theft as a credential-compromise event requiring session revocation and token rotation. Saved Wi-Fi passwords on Android raise the stakes beyond the handset, potentially exposing local wireless networks and any service for which the user reused the password (The Record).
The broader lesson is that third-party web scripts can carry third-party risk at scale. The Plerdy compromise reached hundreds of sites through one shared component, including sites associated with military and defense manufacturing. Monitoring the provenance and integrity of embedded scripts is therefore a control against both targeted and opportunistic collection (The Record).
Method and sources
This analysis relies on The Record's November 5, 2026 report on Sekoia's findings, Sekoia's “Poisoned Source” investigation, and Google Threat Intelligence Group's March 18, 2026 analysis of DarkSword. The Record supplied the campaign attribution, delivery infrastructure, affected device paths and collection scope; GTIG supplied the DarkSword chain description, patch chronology and observations of multiple actors using the tool.
The two sources overlap on DarkSword but differ in scope. GTIG documented DarkSword's original zero-day development and later proliferation, while Sekoia examined its use in the APT29 operation against already-patched vulnerabilities. Claims about successful compromise, victim numbers and specific targets remain unestablished because neither source published them.