TL;DR

  • what: APT29-linked operators compromised legitimate websites, built lookalike domains and poisoned the Plerdy SEO Tracker script to fingerprint mobile visitors and serve platform-specific N-day exploit chains.
  • impact: Compromised iPhones on iOS 18.5 lose SMS, iMessage, keychain, WhatsApp, Telegram, photos and health data, while Android devices running Chrome 139 to 145 lose Chrome data and Wi-Fi passwords.
  • fix: Every CVE in the chains is an N-day already patched by Apple and Google, so current iOS and Chrome builds close the exploitation paths, and Plerdy's poisoned main.js was live only between August 27 and September 3, 2026.
  • who: Mobile users visiting defense, military equipment, chemical industry and Eastern European political websites, plus any organization whose staff browse those sites on unpatched phones.

A Russia-linked intrusion set tracked as APT29 has run a watering hole operation that turns an ordinary page visit into full mobile device compromise. French security firm Sekoia discovered the campaign in mid-October 2026 and named it Poisoned Source. It used three delivery vectors at the same time: compromised legitimate websites, lookalike domains, and a supply chain compromise of Plerdy SEO Tracker, a Ukrainian web analytics service. Every path ended at the same JavaScript loader. That loader profiled the visitor's device and browser, then served one of three N-day exploit chains built for iOS or Android. On the most capable chain, the output was a near-complete copy of the victim's iPhone.

Three Roads to One Loader

Sekoia researchers Amaury-Jacques Garçon and Félix Aime describe the infection vectors as follows:

  • Compromised legitimate websites carrying injected malicious JavaScript. Victims include a major trade association representing U.S. chemical industry companies, a far-right European political party, and a Bulgarian military-related website.
  • Lookalike sites imitating high-profile web properties in the U.S., Ukraine, the Czech Republic and Bulgaria, including america250[.]holiday.
  • A supply chain compromise of Plerdy SEO Tracker between August 27 and September 3, 2026. During that window, malicious code was injected into a.plerdy[.]com/public/js/click/main.js, so every site loading the tracker served the attacker's code to its visitors.

Of the three, the Plerdy vector reached the most sites. One poisoned third-party script spread the loader across every customer site that embedded it, with no need to breach each site individually. Sekoia reports that this vector reached army, special forces and military equipment websites, including ballistic and UAV-focused sites.

⚠️ No click required — The loader runs in the browser as soon as a page loads. A visitor only has to open a trusted site that embeds the compromised script. There is no download, no permission prompt and no phishing lure to spot.

The Exploit Chains

After fingerprinting the device, the delivery infrastructure picks one of three exploit classes. iOS targets get DarkSword, an exploit kit that originated with a commercial surveillance vendor. Android targets get a Chrome chain that drops a payload Sekoia calls AndroSnitch.

  • Class A targets iOS 16.7. It chains CVE-2025-43529 (also used by DarkSword) with CVE-2024-27834 to deliver JavaScript malware that steals cookies.
  • Class B targets iOS 18.5. It uses the full DarkSword chain: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. The payload exfiltrates SMS and iMessages, the Apple Mail Envelope Index and Protected Index SQLite databases, voicemail, WhatsApp and Telegram databases, iCloud Keychain, Wi-Fi passwords, contacts, call history, Safari history and cookies, photos, and data from Apple Health, Calendar, Notes and iCloud Drive.
  • Class C targets Android devices running Chrome 139 through 145, explicitly skipping version 143 for reasons that are not known. It chains CVE-2026-3910 and CVE-2025-27038 for remote code execution, sandbox escape and privilege escalation, then deploys AndroSnitch to collect Chrome data and Wi-Fi passwords. It does not establish persistence.

All three classes send stolen data to one endpoint: ad.starx-net[.]com:8881/telemetry/v12. The Android chain also includes an unusual kill switch. If the device model identifier is SM-S938B, the Samsung Galaxy S25 Ultra, exploitation stops. Sekoia has not explained why that model is excluded.

Attribution: The ANDROSNATCH Lineage

The AndroSnitch name comes from its similarity to ANDROSNATCH, a Chrome cookie stealer Google documented in August 2024. That earlier campaign was a suspected APT29 watering hole aimed at Android users visiting a Mongolian government website, using a Chrome chain built on CVE-2024-5274 and CVE-2024-4671. The overlap in payload design, delivery model and targeting is the basis for linking Poisoned Source to APT29.

Sekoia also states the wider implication directly: state-sponsored actors keep reusing mobile exploit frameworks built by commercial surveillance vendors. "The adoption of packaged N-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation," the researchers wrote. APT29 did not need a zero-day. It needed a pool of unpatched phones and a way to reach them.

Targeted or Opportunistic?

Sekoia does not claim to know whether the operators wanted specific site visitors or as many unpatched devices as possible, collecting broadly and sorting for value afterward. The victim list points to strategic intent anyway. Defense contractors, military equipment sites, a Bulgarian military portal, a chemical industry trade group and European political organizations all draw visitors who matter to Russian intelligence collection tied to the war in Ukraine.

DarkSword Is Spreading Beyond APT29

Poisoned Source is not the only DarkSword activity this quarter. A few weeks earlier, iVerify and Report URI described a P7 variant of DarkSword delivered through ad infrastructure. One case used a World Cup themed Instagram ad served from ad-track[.]live. A separate criminal campaign called DeadTag buys expired domains behind old analytics and advertising tags that thousands of websites still load. Its script filters out bots, scanners and automated browsers, then sends iPhone visitors to Coruna (iOS 13 to 17.2.1) or DarkSword P7 (iOS 18.4 to 18.7).

Third-party script trust is the common thread — Poisoned Source and DeadTag both get their reach from JavaScript that site owners embed and stop thinking about. In one case the vendor's own script was altered. In the other, an abandoned tag domain was taken over. Either way, the site serves attacker code under its own name.

Vendor Fixes and Exposure

Every CVE in these chains is an N-day, so Apple and Google have already shipped patches. The fingerprinting logic targets specific older builds: iOS 16.7, iOS 18.5 and Chrome 139 through 145 on Android. Devices on current iOS and Chrome releases fall outside those windows. The Plerdy compromise lasted from August 27 to September 3, 2026, but the compromised websites and lookalike domains were separate vectors and may have stayed active longer. The real exposure is the gap between patch release and patch adoption on mobile fleets, especially personal devices used for work and phones carried by staff in defense, government and critical industry roles.

RedEye Assessment

Poisoned Source shows a well-resourced state actor getting high-end mobile access with packaged exploits, a poisoned analytics script and a precise list of target websites. The data exposed on a single compromised iPhone, including keychain secrets, messaging databases, mail indexes and session cookies, is enough to pivot into corporate identity and cloud accounts. Organizations with staff in defense, chemical, government or Eastern European policy work should assume those people visit the kinds of sites this campaign weaponized. RedEye Security can assess your mobile fleet exposure, third-party script dependencies and identity blast radius from a compromised device.

Originally published on RedEye Threat Intelligence.