APT29 Poisoned Source: Hijacked Web Scripts Target iOS and Android

Sekoia has linked a mobile watering-hole operation it calls Poisoned Source to APT29, the Russia-linked group, in a report published on 4 November 2026. The APT29 Poisoned Source campaign reached phones through hacked websites, lookalike domains and a compromised Ukrainian analytics script, so the risk for EU firms runs through ordinary web tags and unpatched staff devices, not phishing emails.

What is the APT29 Poisoned Source campaign?

Poisoned Source is Sekoia’s name for a campaign that turns trusted web pages into exploit delivery points for phones. The French security company spotted the activity in mid-October 2026 and shared its technical report with The Hacker News, which published it on 4 November.

Sekoia researchers Amaury-Jacques Garçon and Félix Aime describe a chain that starts with a fingerprint and ends with a platform-specific exploit for iOS or Android. The APT29 link is Sekoia’s assessment, not a government attribution. If you file a NIS2 or DORA incident report, describe the activity by the vendor’s name and evidence rather than as a confirmed Russian state operation.

Sekoia also says the intent behind the site selection remains unclear. Still, the compromised sites “are likely to attract high-value or strategically important visitors in the context of the Russia-Ukraine war.” This is a selective trap, not a phone worm.

How did the three infection paths work?

Every path led to the same JavaScript loader, which profiled the visitor before any exploit was served. “The injected JavaScript code collects browser and device attributes. Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android,” the Sekoia researchers wrote. Nothing malicious reaches the phone until the fingerprint is in.

• Compromised legitimate sites. The loader was injected into real websites. Sekoia cites a major US trade association representing chemical companies, a far-right European political party and a Bulgarian military-related site.
• Lookalike domains. Fake copies of high-profile US, Ukrainian, Czech and Bulgarian sites. One impersonated a prominent US site with an “america250” theme, riding interest in the US 250th anniversary. Sekoia treats it as a lure, not as command infrastructure.
• A poisoned analytics vendor. Between 27 August and 3 September 2026, malicious code sat inside the public click-tracking script of Plerdy SEO Tracker, a Ukrainian web-analytics and SEO service, served from a.plerdy[.]com/public/js/click/main.js. Sekoia says this path spread through army, special-forces and military-equipment websites.

The Plerdy path is the one web and marketing teams own. A site that embeds a vendor’s script runs whatever that vendor serves, on every page view. Compromise one small analytics provider and your code runs in the browsers of every customer site’s visitors, without touching those sites. The Convertr analytics skimmer used the same mechanics against checkouts.

Which iOS versions does DarkSword target, and what does it steal?

The iOS attack had two tiers: a light chain aimed at iOS 16.7 that steals browser cookies, and a full DarkSword chain aimed at iOS 18.5 that exfiltrates nearly everything on the phone. Both rely on publicly known N-day bugs that already have fixes, so the exposure is any iPhone that has not been updated.

Class A exploits CVE-2025-43529 (the same flaw DarkSword uses) and CVE-2024-27834, then runs JavaScript malware that lifts browser cookies. A stolen session cookie for Microsoft 365, Google Workspace, a CRM or a banking portal can let an attacker replay a logged-in session from their own infrastructure, often with no password or MFA prompt.

Class B chains five bugs: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. The harvest list reads like a forensic acquisition:

• SMS, iMessage, voicemail and call history
• The Apple Mail Envelope Index and Protected Index SQLite databases
• WhatsApp and Telegram databases
• iCloud Keychain and saved Wi-Fi passwords
• Contacts, photos, Safari history and cookies
• Apple Health, Calendar, Notes and iCloud Drive data

For an employer, the Keychain and Wi-Fi entries turn one phone into a wider incident. Saved passwords cover every service the user reaches from the device, and an office Wi-Fi pre-shared key works for anyone parked outside. Mail and messaging databases expose client data, deal talk and the internal contacts an attacker needs for the next lure.

All three exploit classes, on iOS and Android, send stolen data to a single endpoint on a non-standard port with a versioned telemetry path. Sekoia lists the host, port and path in its IOC set; take them from the report, not from reposts.

What is AndroSnitch, and which Chrome versions are hit?

On Android, Poisoned Source targets Chrome 139 through 145, skipping 143, and drops a stealer Sekoia calls AndroSnitch. The Class C chain exploits CVE-2026-3910 and CVE-2025-27038 to gain code execution in the browser, escape Chrome’s sandbox and escalate privileges.

AndroSnitch collects Chrome data and Wi-Fi passwords. It does not establish persistence, so a reboot clears it, but by then the cookies and credentials are already gone. The name reflects its similarity to ANDROSNATCH, an earlier Chrome cookie stealer.

Two exclusions stand out. Chrome 143 is skipped “for reasons that remain presently unknown.” And the chain checks the device model identifier and stops if it reads SM-S938B, the Samsung Galaxy S25 Ultra. Sekoia offers no explanation for either. What the checks do show is precise version fingerprinting: your exposure is an outdated fleet, not chance targeting.

How does Poisoned Source connect to ANDROSNATCH, DarkSword and DeadTag?

The clearest thread to earlier APT29 activity is ANDROSNATCH. Google documented it in August 2024 as the Chrome cookie stealer in a suspected APT29 watering hole on a Mongolian government website, using CVE-2024-5274 and CVE-2024-4671. Same objective, same delivery model, two years apart.

DarkSword is not exclusive to APT29, and that is Sekoia’s main conclusion: “This operation also confirms the continued reuse of CSV [Commercial Surveillance Vendors] mobile exploit frameworks, such as DarkSword, by state-sponsored intrusion sets.” A state actor no longer has to build an iOS chain from scratch.

Do not merge Poisoned Source with the other campaigns reported in the same period:

• DarkSword P7 via ads. iVerify and Report URI described a newer variant delivered through “half-click” attacks, including a World Cup-themed malicious Instagram ad served from ad infrastructure.
• DeadTag. A separate criminal campaign that re-registers expired domains behind old analytics and ad tags still loaded by thousands of websites. Report URI counts more than 660 expired and re-registered domains in the DeadTag network. It serves Coruna to iOS 13 through 17.2.1 and DarkSword P7 to iOS 18.4 through 18.7. Scanners, search engines and anything bot-like “gets nothing,” Report URI says.
• Coruna. Built by a nation-state actor for targeted work, it leaked after disclosure and now serves multiple groups. Zimperium zLabs counted 608 domains delivering Coruna-family code as of October 2026.

How the Coruna and DarkSword lures behave

Zimperium’s analysis, by researcher Santiago Rodriguez, places the lures on dating portals, AI-companion platforms, crypto promotions, streaming services and hacked sites using hidden iframes. Many pages tell visitors to leave in-app browsers and reopen the link in Safari, where the chain is built to fire.

iPhones on iOS 17.2.1 or earlier get the legacy Coruna framework, with byte-identical JavaScript across recovered configurations; newer builds get a DarkSword-derived chain. As Scott Helme of Report URI put it: “Simply opening the page is enough for your device to be compromised.”

Who in Cyprus and the EU is exposed?

Cyprus firms are unlikely to be the named target, but exposure depends on what staff read on their phones, not on where the company is registered. Shipping teams following defense-equipment or industry-association news, EMI and CASP executives tracking sanctions, and corporate service providers with Eastern European clients all browse the kind of sites Sekoia describes.

Two questions decide whether you have work to do. Did any of your own websites load the Plerdy click-tracking script between 27 August and 3 September 2026? If so, your visitors may have been profiled and served exploits from your domain, which needs a GDPR and NIS2 assessment.

And do any managed or personal devices used for work run iOS 16.7, iOS 18.5 or Chrome 139-145 on Android? If either answer is yes, or unknown, the steps below apply.

What should security teams do now?

1. Inventory third-party scripts. Search page source, tag manager containers and CSP reports for Plerdy. Remove tags nobody owns; DeadTag shows abandoned tags become someone else’s code.
2. Enforce mobile patch levels. Set minimum iOS versions in MDM and block non-compliant devices from mail and SaaS. Force Chrome updates through managed Google Play.
3. Hunt the endpoint. Search proxy and DNS logs for Sekoia’s published exfiltration host, and for mobile traffic to versioned telemetry paths on non-standard ports.
4. Assume cookie theft first. Revoke sessions for exposed users and review identity logs for session reuse from new ASNs or impossible travel.
5. Treat a Class B suspicion as a full breach. Rotate Keychain-stored credentials, change shared Wi-Fi keys and treat mail and messaging content as disclosed. Preserve the device (sysdiagnose plus the visited URL) before wiping.
6. Brief high-risk staff. A page that insists you “open in Safari” is a red flag, and a link scanner’s clean verdict proves little against cloaked delivery. Apple’s Lockdown Mode is worth enabling for executives who travel or handle sensitive files.

A practitioner’s note

When we review client-side code on Cyprus web estates, the tag list rarely has an owner. Marketing adds a heatmap tool for one campaign, the contract ends, the script stays. We regularly find tags calling vendors the client stopped paying years ago, and occasionally a domain that has lapsed.

A web application penetration test that maps every external script is the quickest way to find them. For the phone side, an assumed breach assessment that starts from one stolen executive session shows how far a cookie actually travels.

What is still unknown?

Quite a lot. Sekoia has not stated the operation’s intent or published a full victim count. The reporting does not explain how attackers got into Plerdy’s delivery pipeline or how many customer sites loaded the poisoned script during the eight-day window. The Chrome 143 and Galaxy S25 Ultra exclusions remain unexplained, and it is not clear whether APT29’s copy of DarkSword came from the same source as the criminal deployments.

None of that changes the response. Third-party script control and mobile patch enforcement are both testable controls under NIS2 and DORA, and our NIS2 and DORA readiness work treats them as evidence items, not good intentions.

FAQ

What is the Poisoned Source campaign?

It is Sekoia's name for a mobile watering-hole operation discovered in mid-October 2026. Hacked sites, lookalike domains and a compromised analytics script fingerprint visitors and serve exploit chains for already-patched iOS and Android bugs.

Is APT29 behind Poisoned Source?

Sekoia attributes it to the Russia-linked APT29. That is a vendor assessment, not a government statement. The Android payload resembles ANDROSNATCH, which Google tied to a suspected APT29 campaign in 2024.

What happened to the Plerdy SEO Tracker?

Between 27 August and 3 September 2026, attackers injected malicious code into Plerdy's public click-tracking script. Any site loading it in that window served the profiling loader to its visitors.

Which iOS versions does DarkSword target in this campaign?

The full DarkSword chain targets iOS 18.5, while a lighter cookie-theft chain targets iOS 16.7. Updating to a current iOS release closes the N-day bugs involved.

Does AndroSnitch stay on the Android device?

No. AndroSnitch collects Chrome data and Wi-Fi passwords and does not establish persistence, so the response is session revocation and credential rotation rather than malware removal.

If you are not sure which third-party scripts your sites load today, start there. Our web application penetration testing maps every external tag and what it can reach.