A visitor opens a Ukrainian military-equipment website on a phone and does nothing else. No link clicked, no file downloaded, no permission granted. The page loads normally, with the same third-party analytics script it has always carried. Underneath, malicious JavaScript measures the device. It reads the browser and operating system and checks whether the phone matches a vulnerable build. If it does, the page itself becomes the delivery mechanism.
The attack needs no second tap. On an unpatched Android phone, the exploit chain lifts Chrome data and saved wifi passwords. On an unpatched iPhone, the lighter exploit chain takes browser cookies. The deeper one empties the phone. It pulls messages, the WhatsApp and Telegram databases, contacts, and call history. Keychain passwords, saved wifi keys, photos, and iCloud Drive go too. The visitor installs nothing. Loading the page is enough.
Surprise surprise. As it turns out, the script was poisoned. Between August 27 and September 3, the Russian adversary CrowdStrike tracks as COZY BEAR (aka Midnight Blizzard, APT29) compromised Plerdy SEO Tracker. Plerdy is a Ukrainian web analytics service loaded by thousands of websites, most of them Ukrainian. For one week, every visitor to a site running the tracker also loaded COZY BEAR's fingerprinting code. Sekoia, the French firm, uncovered the operation in mid-October and named it Poisoned Source. It assesses with moderate to high confidence that the campaign belongs to COZY BEAR, the intrusion set attributed to Russia's foreign-intelligence service, the SVR.
COZY BEAR reached visitors three ways, and the Plerdy compromise was the broadest. When it could compromise a legitimate site directly, it did. COZY BEAR placed its code on the pages of a Ukrainian gas producer, a United States chemical-industry trade association, a far-right European political party, and a Bulgarian military-related site. When direct compromise failed, the adversary registered lookalike domains as reverse proxies. These rewrote the legitimate pages on the fly to inject its code. One mimicked america250.org, the official site of the United States 250th-anniversary celebration. Another impersonated Raffles London at The OWO, a hotel inside the old War Office building beside the Ministry of Defence and Downing Street. President Zelensky had stayed there weeks earlier.
All three routes lead into the same machinery, a profiling script COZY BEAR named UltimateFingerprinter. It pulls 394 fields from the browser through sixty-one collectors, reaching the canvas, the sensors, and even USB and Bluetooth. The code hides inside a 2.3-megabyte copy of a common JavaScript library, padding filling roughly 98 percent of the file. Sekoia reads the bulk two ways. It is either cover to look legitimate or a way to defeat automated analysis by overrunning the context window of a large language model. For all that collection, the fingerprint barely shapes the attack. The server checks little more than whether the visitor holds a touchscreen phone. Then it uses the operating system and browser version to pick an exploit chain. Why the adversary gathered so much more stays unclear.
None of the three exploit chains holds a zero-day. Every flaw was fixed by Apple or Google before the campaign began. A fully updated device shrugs off everything Sekoia recovered. An exploit does not die when the vendor ships the patch. It changes economic status. The scarcity premium disappears, and the engineering keeps working against every phone whose owner has not installed the fix. COZY BEAR hunts the population the patch cycle leaves behind, where yesterday's expensive bug still pays.
The iPhone exploit chain reuses the DarkSword vulnerabilities. DarkSword is a suspected commercial-surveillance-vendor exploit kit for iPhones. COZY BEAR reimplemented it rather than copying the leaked build uploaded to VirusTotal in September, and how it acquired the knowledge to rebuild the exploit chain stays unknown. COZY BEAR has done this before. In 2024, Google's Threat Analysis Group caught suspected COZY BEAR watering holes on Mongolian government sites. The iPhone and Chrome exploits were identical or strikingly similar to those sold by Intellexa and NSO Group, and Google could not explain how the Russians obtained them. DarkSword shows the same drift from another angle. In March, Google documented the kit spreading across commercial vendors and state-linked actors. One is a suspected Russian espionage cluster it tracks as UNC6353, which ran DarkSword in watering holes on Ukrainian sites. Google did not tie that cluster to COZY BEAR. Yet the shape is the same, and the surveillance industry's tools keep arriving in Moscow's hands.
A sophisticated mobile exploit chain no longer has to be built for each operation. It can be bought, leaked, and adapted, and each hand-off lowers the cost and the skill the next buyer needs. For an adversary content to target the unpatched, patch latency becomes inventory.
None of the exploit chains installs anything lasting. The lighter paths take cookies or credentials and leave. Even the deep iPhone exploit chain, which empties the device, plants no implant. Permanent control is not the point. For the cookie theft, the session is the prize. A valid authentication cookie lets its holder walk back into webmail or a cloud service as the victim. There is no password to crack and no second factor to defeat, because the login already happened. For an intelligence service reading a diplomat's or a soldier's mail, the identity already authenticated is worth more than malware left behind.
The Plerdy net swept Ukrainian army, special-forces, military-recruitment, and military-equipment sites. Several make ballistics and drones. The hand-built lookalikes aimed narrower, at the guests of a London hotel ringed by British government and the visitors of an American celebration. The SVR's remit is foreign intelligence, and its cyber operations increasingly serve Russia's war aims. Ukraine's military, its defense suppliers, and the officials around them sit on exactly the questions Moscow is paid to answer.
A ministry network shows what an organization holds. A phone shows what one person reads, where they go, and whom they speak with. It holds the conversations that never touch the employer's systems. Mandiant has long documented COZY BEAR chasing email, cloud, and third-party access for whatever serves Russian strategy. Both targeting models feed that mission. Sekoia cannot yet say whether COZY BEAR chose specific people in advance or cast wide and sorted the haul later. Target narrowly and the watering hole is an ambush. Cast broadly and every compromised phone is raw intelligence waiting to be read.
COZY BEAR never had to talk a single target into clicking a spear-phishing link. Plerdy already sits inside thousands of sites as ordinary analytics code, so compromising it once turns every visiting browser into a distributor. Trust carries the exploit farther than any lure can.
A trusted script supplies reach, and patched bugs supply entry. A leaked spyware kit supplies the engineering, and slow patching holds the opening. Not one of these pieces is new. Their combination lets a nation state run mobile espionage at scale, with no fresh vulnerability for any target, no implant on any phone, and no contact with a single victim. All it takes is enough people standing on the wrong side of a software update.
Apple and Google shipped the fixes. Sekoia published the exploit. The attack still works on every phone still missing the update. For the SVR, the phone is only ever a shortcut to the person carrying what Moscow wants to read. The page is legitimate. The exploit is old. The intelligence is fresh.