A cyberespionage campaign tied to Russia’s APT29 recently leveraged hijacked web analytics scripts to deploy sophisticated exploit chains targeting both iOS and Android users. This operation, dubbed “Poisoned Source,” was uncovered in mid-October 2026 by French security firm Sekoia. Attackers compromised a Ukrainian analytics service, created lookalike domains, and injected malicious JavaScript into legitimate sites. Their goal: steal cookies, Wi-Fi credentials, and even full mobile device data.
How the Attack Works
The campaign uses three primary infection vectors. First, malicious scripts are injected into legitimate websites via file infections. Second, lookalike domains impersonate high-profile sites in the U.S., Ukraine, Czech Republic, and Bulgaria to lure in visitors. Third, the attackers compromised the Plerdy SEO Tracker service between August 27 and September 3, 2026 by injecting malicious code into its public JavaScript file. All roads ultimately lead to a loader script that fingerprints devices and browsers, then launches platform-specific exploits.
Exploit Chains & Payload Details
For iOS users, the DarkSword exploit kit is used. One exploit chain (“Class A”) targets iOS 16.7 via CVE-2025-43529 and CVE-2024-27834 to steal cookies. A more intense chain (“Class B”) affects iOS 18.5 and involves multiple vulnerabilities—CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520—allowing harvest of SMS, messages, passwords, iCloud Keychain, photos, call history, and more.
On Android, the attackers focus on Chrome versions 139 to 145 (excluding 143 for unclear reasons). Exploiting CVE-2026-3910 and CVE-2025-27038, they deploy a payload called AndroSnitch to steal browser data and Wi-Fi credentials. Interesting twist: devices like the Samsung Galaxy S25 Ultra are explicitly exempted—if the model matches, the attack is aborted.
High-Value Targeting & Supply Chain Strategy
The campaign isn’t trying to hit every mobile user. The hacked sites include military and political organizations, a U.S. chemical industry trade group, a far-right European party, and a Bulgarian military-affiliated site. Many targets are strategically relevant in the Russia-Ukraine conflict. By injecting malicious code into Plerdy SEO Tracker—a service used by many sites—APT29 reached dozens of these sensitive domains without having to compromise each one individually.
In addition to Poisoned Source, two related exploit toolkits—Coruna and DarkSword’s P7 variant—have evolved in parallel. These kits are now spread via expired domains, malicious ads, lures like fake survey or prize pages, and other shady ad infrastructure. Even visiting a compromised site, without clicking anything, can trigger the exploit if the browser and OS are vulnerable.
So what does this mean? Attackers are lowering technical barriers by using ready-made exploit chains and supply-chain subversion. The consequences stretch far beyond individual users—any organization whose staff or stakeholders access technical, political, or defense content is now at elevated risk.
What to Watch: Ensure devices are updated to patched versions, audit third-party scripts, monitor domains used by analytics and ad services, and track any lookalike or luring domain traffic. The rise of mobile exploit kits like DarkSword/Coruna shows the mobile landscape is now front and center in nation-state threat operations.
In short, the Poisoned Source campaign is a stark reminder of how digital supply chains and web infrastructures have become prime battlegrounds. The risks are not theoretical—threats to privacy, state secrets, and critical infrastructure are very real.
