A script called UltimateFingerprinter pulls 394 fields of data from a visiting phone in under a second, from canvas rendering quirks to Bluetooth and NFC capability flags, then checks three of them to decide whether to hand over a working exploit: is the screen width plausible, is the screen height plausible, and is the touch-point count nonzero. The other 391 fields appear to do nothing. That mismatch, buried in a 2.3-megabyte JavaScript file that is 98% padding, is one of the odder details in a report the French security firm Sekoia published on November 4 about a watering-hole campaign it calls Poisoned Source, which it attributes with “moderate to high confidence” to APT29 — also tracked as Midnight Blizzard or Cozy Bear, and widely linked to Russia’s Foreign Intelligence Service (SVR).
Three ways in, one script, zero zero-days
As Ars Technica reported, the campaign ran through three delivery routes that all fed the same fingerprinting script and exploit backend. The first was a direct website compromise: a Ukrainian gas producer, Ukrainian army and UAV-equipment pages, a US chemical-industry trade association, a Czech far-right party and a Bulgarian military-linked site all had malicious JavaScript inserted into their templates, according to Sekoia’s report. The second was a supply-chain hit on Plerdy, a web-analytics tracker loaded by thousands of sites, the large majority Ukrainian; Sekoia found the legitimate Plerdy script altered between August 27 and September 3, 2026, to pull in a second script from attacker infrastructure, exposing hundreds of sites’ visitors for that one-week window. The third was two lookalike domains acting as reverse proxies — america250[.]holiday, registered May 19, 2026, mirroring america250.org, the nonpartisan body running the US semiquincentennial celebrations, and theowo[.]club, registered June 18, 2026, mirroring the website of Raffles London at The OWO, a five-star hotel built into the former Old War Office building, next to the Ministry of Defence and 10 Downing Street. Both proxies passed through the real site’s content unchanged while quietly injecting the exploit script, so a visitor saw nothing wrong. Sekoia said it suspected the America250 site was picked because a national-anniversary celebration makes a plausible pretext for an invitation-themed phishing lure; open-source reporting cited by Ars Technica says Ukrainian President Volodymyr Zelenskyy stayed at the OWO on October 14.
| From | To | How |
|---|---|---|
| Compromised sites (gas producer, army/UAV pages, trade groups) | UltimateFingerprinter (394 fields, 61 collectors) | |
| Hijacked Plerdy script (Aug 27–Sep 3, 2026) | UltimateFingerprinter (394 fields, 61 collectors) | |
| Proxy domains (america250.holiday, theowo.club) | UltimateFingerprinter (394 fields, 61 collectors) | |
| UltimateFingerprinter (394 fields, 61 collectors) | Delivery gate (checks screen size & touch points) | |
| Delivery gate (checks screen size & touch points) | Chain A: old iOS (cookie theft) | iOS 16.0–17.4 |
| Delivery gate (checks screen size & touch points) | Chain B: DarkSword (full device dump) | iOS 18.5 |
| Delivery gate (checks screen size & touch points) | Chain C: Android Chrome (cookies & Wi-Fi password) | Chrome Android |
Based on Sekoia Threat Detection & Research
Once UltimateFingerprinter’s gate passes a visitor, the backend serves one of three exploit chains, matched to platform and OS version. Chain A targets iOS 16.0 through 17.4, chaining CVE-2025-43529 with CVE-2024-27834 to defeat Apple’s pointer-authentication protection and steal cookies out of Safari’s binary cookie store. Chain C targets Chrome 139 through 145 on Android, skipping version 143 and, oddly, the Samsung Galaxy S25 Ultra specifically; it pairs a renderer flaw (CVE-2026-3910) with a sandbox escape in the Adreno GPU driver (CVE-2025-27038) to run a payload Sekoia calls AndroSnitch, which exfiltrates Chrome’s saved cookies, logins, history and Wi-Fi configuration file.
Chain B is the heaviest, and the one that gives the campaign its most notable detail. It targets iOS 18.5 and strings together five already-patched CVEs — 2025-43529 for initial code execution, 2026-20700 to bypass pointer authentication, 2025-14174 and 2025-43510 for a sandbox escape, and 2025-43520 for privilege escalation — to pull iMessage, WhatsApp and Telegram databases, Keychain credentials, Wi-Fi passwords, call logs, contacts, calendar entries, Safari history, Health data, location history and photos off the device. Sekoia matched this chain’s structure to DarkSword, an iOS exploit kit it describes as built by a commercial surveillance vendor. DarkSword was first disclosed publicly on March 18, 2026 in simultaneous posts by Google’s Threat Analysis Group, iVerify and Lookout, which found it running against Saudi, Turkish and Malaysian targets through customers of a firm called PARS Defense, as reported by The Hacker News. Apple had already patched the chain’s core bug, CVE-2025-43529, in iOS 18.7.3 in December 2025; five days after the March disclosure, the full exploit code leaked on GitHub. By August, APT29 had a working copy to deploy against outdated phones, without having to find or buy a zero-day of its own.
| Chain | Platform targeted | Exploit path | Data taken |
|---|---|---|---|
| Chain A | iOS 16.0–17.4 | CVE-2025-43529 → CVE-2024-27834 | Safari/WebKit cookies |
| Chain B (DarkSword) | iOS 18.5 | CVE-2025-43529 → CVE-2026-20700 → CVE-2025-14174 & CVE-2025-43510 → CVE-2025-43520 | iMessage, WhatsApp, Telegram DBs, Keychain, Wi-Fi passwords, photos, location |
| Chain C | Android Chrome 139–145, excl. 143 | CVE-2026-3910 → CVE-2025-27038 | Chrome cookies, saved logins, history, Wi-Fi config (not Galaxy S25 Ultra) |
None of the three chains used a zero-day, and none installed anything that survives a reboot. Sekoia’s own summary is blunt: “a user running an up-to-date operating system is safe from these attacks.” That is the actual headline finding, separate from the attribution question: every CVE in all three chains had a public patch before APT29 deployed it, which means the campaign’s entire cost was the work of standing up proxy infrastructure and wiring together exploit code that other people had already written, tested and, in DarkSword’s case, leaked. That is also the broader pattern Google’s Threat Analysis Group flagged in a 2024 report on a structurally similar APT29 campaign against Mongolian government websites, which used exploit code identical or near-identical to code previously fielded by the commercial spyware vendors NSO Group and Intellexa. Once a mobile RCE chain leaks, the marginal cost of reusing it drops close to zero for anyone who can host a reverse proxy and parse a fingerprint.
Why Sekoia blames Russia, and what it doesn’t know
Sekoia’s attribution rests on three legs, none of them a hack-back or a confession. First, leftover files on one of the directly compromised sites matched indicators from a private 2025 report on an earlier APT29-attributed watering hole. Second, the delivery framework’s structure resembles the 2024 Mongolia campaign that Google’s TAG tied to APT29 with moderate confidence, down to the shared goal of cookie theft via an iframe-served reconnaissance payload. Third, victimology: a Ukrainian gas producer, Ukrainian military-equipment pages, a Czech far-right party and a Bulgarian military-linked site skew toward the set of targets Russian intelligence has hit before. None of that is as strong as, say, an indictment with named defendants, which is why Sekoia’s confidence level is “moderate to high” rather than certain.
What the report does not give is a victim count. Sekoia’s language stays qualitative — “thousands” of sites load the Plerdy script, “hundreds” of sites were exposed during the one-week supply-chain window — with no figure for how many phones actually received an exploit, let alone how many were successfully infected. Sekoia says it is working with national CERTs on victim identification and possible infrastructure takedown; that process, not this report, is where an actual infection count would surface. Apple has closed the Chain B vulnerabilities as of iOS 26.3, and the Chrome and Adreno driver bugs behind Chain C are fixed in current builds, so the operative fact for any reader with a phone is simpler than the attribution debate: if the OS and browser are current, none of the three chains Sekoia documented would have worked.