Hackers have infected or copied websites in the US, Ukraine, the Czech Republic and Bulgaria to steal data from visitors' phones. One is a Bulgarian site linked to the army, French cybersecurity firm Sekoia said in a technical report.
Sekoia's threat detection and research (TDR) team found the campaign in mid-October 2026. The firm believes the Russian group APT29, also known as Midnight Blizzard, Cozy Bear and The Dukes, is likely behind the attacks.
The group has Russian links and is usually attributed to Russia's Foreign Intelligence Service (SVR). Sekoia says it has medium to high confidence in this view, based on technical overlaps and the way the attackers operate.
It is a "watering hole" attack: malicious code is planted on sites that victims visit on their own. It targets iOS and Android phones, and steals data without any action by the user.
Sekoia found three ways the infection spreads. In the first, the attackers inserted JavaScript straight into real websites. In the second, they registered look-alike domains that sit between the visitor and the real page. The third runs through Plerdy SEO Tracker, a web analytics tool that was compromised.
All three routes lead to the same code, which loads an outside script. The script checks the visitor's browser and device. The attackers' server then picks a ready-made chain of attacks to suit the phone and browser version. The chain uses known security flaws that have not yet been fixed, and needs no action from the user.
One of the chains is DarkSword, an attack kit for iOS. Sekoia says a commercial spyware vendor probably built it, and that it was uploaded to VirusTotal in September 2026.
On an iPhone, the final malicious code steals browser cookies or all data on the device. On Android phones, it takes Chrome data and Wi-Fi passwords. It does not stay on the device permanently.
The investigation began with the website of a Ukrainian gas production company. Experts found malicious JavaScript at the top of the site, inserted into the main template. Once the page loads, it adds an outside file that the attackers named UltimateFingerprinter. The file sits on static.flux-telemetry[.]com, with the IP address 109.104.106[.]107 (AS395092).
Sekoia found the same method at a large trade association of US chemical companies and at the site of a far-right European political party. On the Bulgarian site linked to the army, the hackers replaced an existing JavaScript library. On some sites they left the template alone and added the malicious code to a real JavaScript file the site already uses.
When they failed to break into a real site, the attackers registered a look-alike, the report says. The look-alikes alter the page on the fly and insert JavaScript at the bottom.
The first is america250[.]holiday. It sits in front of america250.org, the official site for the national initiative marking the 250th anniversary of US independence, which is protected by Cloudflare. Sekoia says the site was probably chosen because of the big national celebration, and may have served as a pretext for targeted phishing with invitations.
The second, theowo[.]club, is now offline. It copied the website of the luxury hotel Raffles London at The OWO, which is housed in the historic Old War Office building in London. The hotel is close to the UK Ministry of Defence and to 10 Downing Street, the residence and office of the British prime minister.
Open sources say Ukrainian president Volodymyr Zelensky stayed there during a visit on 14 October. Sekoia says the attackers may have wanted to use the hotel look-alike to reach diplomatic delegations and senior guests with targeted phishing.
The third route is Plerdy, a Ukrainian visitor analytics tool that runs from the domain a.plerdy[.]com. Thousands of sites load it, the vast majority of them Ukrainian. The service's supply chain was probably compromised from 27 August to 3 September 2026.
In that week alone, hundreds of legitimate sites were exposed to the attack. Through Plerdy, the infection reached sites of the army, special forces and makers of military equipment, including ballistics and drones.
Sekoia says many of the sites with Plerdy probably draw visitors who are valuable to the attackers because of Russia's war against Ukraine. The firm is not sure whether the attackers targeted people visiting specific sites, or infected unpatched phones en masse and then picked out the valuable data.
Requests also reached the attackers' server from sites with no obvious strategic link. All of them load Plerdy SEO Tracker. The value of some of the affected sites remains unclear. Sekoia says, with low confidence, that some may have been chosen because of specific people rather than as part of a broad strategy.
Sekoia is working with the computer emergency response teams (CERTs) of the affected countries. Together they are trying to identify the victims and find a way to shut down the attackers' servers and domains.