APT29 deploys DarkSword via Plerdy compromise for zero-click iOS 18 and Android data theft

The evidence trail shows three distinct infection chains: cookie theft on iOS 16, full extraction via DarkSword on iOS 18.5, and Chrome-based Wi-Fi password and history theft on Android. All relied on watering-hole or supply-chain delivery rather than user interaction, consistent with prior Midnight Blizzard operations that favored legitimate-site compromises over phishing. Sekoia linked the DarkSword toolkit to earlier campaigns in Saudi Arabia, Turkey, and Malaysia, indicating commercial spyware reuse by state actors rather than bespoke development.

Official statements attribute the activity to Russia's SVR, yet the technical artifacts—code overlap with documented Cozy Bear infrastructure and the absence of long-term persistence—align more closely with short-burst collection than sustained access tradecraft. No independent telemetry has publicly confirmed SVR tasking; the pattern instead matches procurement of off-the-shelf mobile implants observed in other SVR-linked operations.

Operational significance lies in the shift to high-value personal devices of diplomats, military contractors, and political figures, bypassing endpoint detection on managed networks. The Raffles London spoof and America250 clone suggest targeting of transient high-profile visitors. Expect continued abuse of regional analytics and content-delivery services as initial access vectors.

Next indicators will likely appear in new Plerdy-style script injections or fresh DarkSword variants within three months; defenders should monitor for anomalous JavaScript on Ukrainian .gov.ua and industrial domains.