A campaign attributed by researchers to the Russia-linked APT29 group has targeted mobile users through compromised websites, fake domains and injected web code, according to The Hacker News’ report on Sekoia’s findings. Sekoia said the JavaScript profiles a visitor’s browser and device before selecting an iOS or Android exploit chain.
The reported payloads include the DarkSword exploit kit for iOS and Android malware capable of extracting Chrome data and Wi-Fi passwords without establishing persistence. The Hacker News reports that the campaign also involved a supply-chain compromise affecting the Plerdy SEO Tracker web-analytics service. Sekoia discovered the activity in mid-October, and said some compromised sites belonged to organizations in the chemical, political and military sectors. The researchers said the intended targeting scope remained unclear.
Related technical research from Zimperium’s zLabs describes how Coruna and DarkSword exploit-kit delivery can operate on iOS, but does not establish that its researchers analyzed the Sekoia-attributed APT29/Plerdy campaign. Zimperium reported that devices running iOS 17.2.1 or earlier received the legacy Coruna chain, while later iOS versions received a DarkSword-derived chain. Its analysis identified 608 domains delivering Coruna-family code through October 2026, including compromised legitimate sites that loaded the exploit through hidden iframes.
Zimperium’s separate analysis found that the related iOS delivery chain could begin inside a webpage without an app installation, permission prompt or further user interaction. That provides technical context for the risk of compromised site dependencies and web scripts, but it is not confirmation that those Coruna and DarkSword observations belong to the APT29-linked campaign reported by Sekoia.
The fetched reports do not provide an official vendor mitigation or establish the number of confirmed device compromises. The APT29 attribution, Plerdy compromise and reported payload capabilities remain claims attributed to Sekoia through The Hacker News, while Zimperium’s findings concern related iOS exploit-kit activity.