A Russian state-backed espionage campaign quietly turned trusted websites, lookalike domains and a hijacked web analytics script into a delivery system for iPhone and Android exploits, according to new research from French security firm Sekoia. The firm attributes the activity, which it calls “Poisoned Source,” to APT29 with moderate to high confidence, and says the operation was aimed at visitors to Ukrainian defense, military and government-adjacent websites as well as selected targets in the United States, the United Kingdom and Europe.
APT29, also tracked as Midnight Blizzard and Cozy Bear, is widely linked to Russia’s Foreign Intelligence Service (SVR). Sekoia’s report, published November 4, 2026, says the campaign relied entirely on known, already patched vulnerabilities. No zero-days were involved, which means phones running current software were not at risk from the exploit chains it describes.
Three ways visitors were funneled to the exploits
Sekoia says it first spotted the campaign in mid-October 2026 and traced 3 separate infection vectors that all ended at the same exploitation framework.
The first was a classic watering hole. The attackers injected malicious script into legitimate websites whose audiences were likely to include intelligence targets. Sekoia named the types of sites rather than the organizations themselves: a Ukrainian gas production company, a major US chemical industry trade association, a far-right European political party, a Bulgarian military-related website and an Australian medical clinic.
The second relied on lookalike domains acting as reverse proxies. Instead of copying a target site, the attackers ran infrastructure that loaded the real site in the background and served it to visitors with malicious code added. One domain imitated america250.org, the official site for the 250th anniversary of the United States. Another, now offline, imitated the website of Raffles London at The OWO, a luxury hotel in the former Old War Office building in Whitehall, close to the UK Ministry of Defence and Downing Street. Sekoia did not say how victims were lured to those domains.
The third and broadest vector was a supply chain compromise of Plerdy, a Ukrainian website analytics and conversion tracking service. Thousands of websites, many of them Ukrainian, embed Plerdy’s tracking script on every page. Between August 27 and September 3, 2026, that script was modified to load the attackers’ code. Sekoia says Plerdy’s customer base includes Ukrainian military and special forces websites as well as sites linked to drone and ballistic weapons programs, which made the script an efficient way to reach a highly targeted audience without breaching each site individually.
The technique mirrors other recent third-party script attacks, including the DebugBear script compromise that drained Polymarket traders and the Magecart hijacking of the Convertr analytics script. In those cases the goal was money. Here, according to Sekoia, it was intelligence collection from mobile devices.
What Plerdy says happened
Plerdy published a security incident notice confirming that an attacker used stolen administrator credentials in August 2026 to gain access to its systems and alter the code served to customer websites. The company said it removed the malicious code on September 3, replaced the compromised credentials, reset all user passwords and ended active sessions on September 4.
According to Plerdy, the attacker also accessed contact data tied to client accounts, including names and email addresses. The company said it reported the incident to CERT-UA, Ukraine’s national computer emergency response team, and that it found no evidence that data belonging to visitors of its customers’ websites was collected through its own systems. Plerdy told customers they do not need to remove its script from their sites. Its notice does not name APT29 or describe the mobile exploits Sekoia documented.
A heavy fingerprinting script with a simple filter
Every vector loaded the same first-stage script, which Sekoia calls UltimateFingerprinter. The script includes 61 separate collectors that gather 394 fields describing the visitor’s browser and device. Sekoia found that about 98% of its 2.3 MB size was padding from a bundled copy of the AngularJS framework that buries the fingerprinting code inside a much larger file.
Despite all that data collection, the decision about who received an exploit came down to very little. Sekoia says the script mainly checked screen dimensions and the number of supported touch points to separate phones from desktop computers. Desktop visitors were left alone. Mobile visitors were sorted by platform and version and sent to one of 3 exploit chains.
The exploit chains
Sekoia grouped the targets into 3 classes. All of the vulnerabilities involved had been patched by Apple, Google or Qualcomm before the campaign used them.
- Class A, older iPhones running iOS 16.7: a WebKit flaw, CVE-2025-43529, combined with CVE-2024-27834 to bypass Pointer Authentication Codes (PAC). This lighter chain focused on stealing browser cookies.
- Class B, iPhones running iOS 18.5: a longer chain Sekoia links to the DarkSword exploit kit, using CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to escape the browser and gain broad access to the device.
- Class C, Android phones running Chrome 139 through 145 (except 143): a Chrome renderer flaw, CVE-2026-3910, chained with CVE-2025-27038 in Qualcomm’s Adreno GPU driver to deliver an infostealer Sekoia calls AndroSnitch. Sekoia noted the chain skipped the Samsung Galaxy S25 Ultra (model SM-S938B).
The Class B chain was the most damaging. Sekoia says it collected SMS and iMessage conversations, Mail data, voicemail, WhatsApp and Telegram data, Keychain passwords, saved Wi-Fi networks, contacts, call history, Safari data, location history, Health data, photos and iCloud Drive files. On Android, AndroSnitch went after Chrome cookies, saved logins and browsing history along with Wi-Fi configuration files.
Neither the iOS nor the Android payloads tried to stay on the device after a reboot. Sekoia says the implants grabbed what they could in a single pass and sent it to one exfiltration endpoint. That smash-and-grab design leaves little on the phone for investigators to find later, but it also means a restart ends the infection.
Why Sekoia points to APT29
Sekoia’s attribution rests on several overlapping links rather than a single piece of proof. Google’s Threat Analysis Group (TAG) told the researchers that the framework closely resembles the one used in APT29’s 2024 watering hole attacks against Mongolian government websites, a campaign in which the group reused iOS and Chrome exploits that matched ones previously sold by commercial surveillance vendors such as NSO Group and Intellexa. A partner national CERT also matched leftover artifacts from the new campaign to a 2025 APT29 operation.
The choice of targets fits APT29’s long-running focus on Ukraine’s war effort and on Western defense and policy circles. The researchers still stop short of certainty, describing their confidence as moderate to high. Sekoia says it is working with CERTs in the affected countries and credited CERT-UA and Google TAG for their help.
The research adds to a busy period for state-backed espionage on BreachNews, following recent reports on Vapor Panda’s Artex campaign and Warp Panda’s VMware ESXi zero-day attacks on law firms. Unlike those operations, Poisoned Source did not need any unknown vulnerabilities. It worked because enough phones in the target audience were months behind on updates.
Indicators shared by Sekoia
Sekoia’s report includes a full list of indicators of compromise. The lookalike domains it named include:
america250[.]holidaytheowo[.]club
Website owners who used Plerdy should review whether their pages loaded the tracking script between August 27 and September 3, 2026. Security teams can search proxy and DNS logs for the domains above and the additional indicators in Sekoia’s report.
How to protect yourself
The most important step is simple: keep phones updated. Every exploit in this campaign targeted software versions that had already received security fixes.
- Install the latest iOS or iPadOS update, and turn on automatic updates in Settings.
- Update Google Chrome on Android through the Play Store and install the latest Android security update offered by your phone maker.
- Restart your phone regularly. Because these implants did not persist, a reboot would have removed them.
- People in high-risk roles, such as those working in defense, government, journalism or policy, should consider turning on Apple’s Lockdown Mode or Android’s Advanced Protection mode.
- If you visited Ukrainian defense or military websites on an outdated phone between late August and October 2026, change important passwords from an updated device and sign out of active sessions on your key accounts.
Organizations that embed third-party scripts should also treat them as part of their attack surface. Limiting which outside domains can run code on a site through a Content Security Policy, and monitoring for unexpected changes to loaded scripts, can reduce the damage when a trusted vendor is compromised.
