APT29 ‘Poisoned Source’: How Ordinary Websites Became Phone Traps

WarBrief Live | November 6, 2026 | Intelligence Report

French security firm Sekoia reported on November 4, 2026 that a campaign it calls “Poisoned Source” turned ordinary websites into traps that silently attacked unpatched iPhones and Android phones. No tap, download or warning was required: opening the wrong page was enough.

Sekoia attributes the campaign, discovered in mid-October 2026, with moderate to high confidence to APT29, the Russian foreign intelligence service (SVR) hacking group also known as Midnight Blizzard and Cozy Bear. That assessment is not proof. What is confirmed is the machinery: three delivery routes, one profiling payload, and three exploit chains built entirely from flaws that had already been patched. A phone running current software was safe; a phone behind on updates was not.

What happened in the Poisoned Source campaign?

A watering hole attack poisons the places a target is likely to visit, rather than attacking the target directly. Sekoia’s Threat Detection & Research team found the campaign while investigating a malicious script on the website of a Ukrainian gas production company. Compromised sites included a US chemical industry trade association, a far-right European political party and a Bulgarian military-related organisation.

Every route delivered the same payload: a JavaScript loader that profiled the visitor’s device, then served a matching exploit chain. The goal was data theft — browser cookies, and in the worst cases Wi-Fi passwords or almost everything on the phone. On Android, the payloads did not persist after the data was sent out. No victim count has been published.

How did the three delivery routes work?

The first route was the simplest: malicious JavaScript injected directly into legitimate websites. The second used lookalike domains acting as a middleman in front of real sites — one copied America250, the initiative marking 250 years of US independence, and another cloned the website of Raffles London at The OWO, a hotel close to the UK Ministry of Defence. Sekoia assesses the hotel clone may have been aimed at diplomatic delegations and prominent guests.

The third route reached furthest. Between August 27 and September 3, 2026, the attackers compromised Plerdy, a Ukrainian web analytics service, injecting their code into the tracking script that thousands of websites load — most of them Ukrainian, including sites run by the army, special forces and military equipment makers.

What could the exploit chains take from each phone?

Class A targeted iPhones on iOS 16.7, chaining CVE-2025-43529 with CVE-2024-27834 to steal browser cookies — enough to reuse logged-in sessions, including webmail. Class B targeted iOS 18.5 with the DarkSword exploit kit, a five-flaw chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520) built to take almost everything on the phone: messages, mail, WhatsApp and Telegram data, Keychain and Wi-Fi passwords, contacts, photos, and Health, Calendar, Notes and iCloud Drive data.

Class C went after Android phones running Chrome versions 139 through 145 — explicitly excluding version 143, for reasons Sekoia says remain unknown — using CVE-2026-3910 and the Adreno driver flaw CVE-2025-27038 to deliver AndroSnitch, which collected Chrome data and Wi-Fi passwords.

Confirmed vs reported: the three vectors, the three chains and the CISA listing are confirmed by Sekoia’s research and CISA’s own catalog. The attribution to APT29 is Sekoia’s assessment at moderate to high confidence, not a proven fact, and no victim count has been published.

Why does Sekoia blame APT29 — and what is still unproven?

The attribution rests on three strands: traces of a 2025 APT29 watering hole operation on one compromised site; similarities with a 2024 APT29 operation against Mongolian government websites that Google’s Threat Analysis Group confirmed; and a victim list centred on Ukraine. None is conclusive alone, and Sekoia presents the link as an assessment, not a certainty.

Intent is also unproven. Sekoia states plainly that it remains unclear whether the attackers meant to hit visitors to specific websites or sought to compromise as many unpatched mobile devices as possible, “indiscriminately exfiltrating data before selectively identifying and exploiting information of interest.” CISA added CVE-2024-27834 to its catalog on November 4 citing active exploitation — but named no actor and did not tie the listing to Sekoia’s findings.

What does Poisoned Source mean for US, UK and EU phone users?

For anyone running current iOS or Android software, the direct risk from this campaign is already closed: every flaw in the three chains had a patch before the campaign began, and Sekoia stresses that “a user running an up-to-date operating system is safe from these attacks.” The exposure sits with older devices, deferred updates and unmanaged handsets. The November 18 CISA deadline applies formally to US federal civilian agencies, but it is a practical marker for everyone else.

The wider lesson is structural. Poisoned Source confirms the continued reuse of commercial surveillance vendor exploit frameworks, such as DarkSword, by state-sponsored intrusion sets. Packaged n-day chains lower the cost and technical threshold of advanced mobile exploitation, and Sekoia assesses their reuse will likely become more frequent. The same economics reshaped ransomware: ransomware-as-a-service operations such as KillSec industrialised attack tooling. See WarBrief’s October 2026 civilian infrastructure cyberattacks report and vulnerability assessment tools for defense contractors. All of WarBrief’s intelligence reporting is collected on the Intel hub.

Assessment and outlook

Poisoned Source shows how state-linked collection has adapted to a patched world. Rather than burning expensive zero-days, the operators assembled a campaign from known flaws, a hijacked analytics provider and a handful of poisoned websites — and reached, in principle, every unpatched phone that wandered onto them. Watering holes are a decade-old APT29 technique; what is new is the scale one supply-chain compromise buys, and how commercial kits turned mobile attacks into a repeatable product.

Three things to watch. First, whether CISA, the UK National Cyber Security Centre or others attribute the campaign or publish indicators of compromise — none have been released for CVE-2024-27834 so far. Second, whether victim disclosures emerge from the Ukrainian sites in the Plerdy blast radius. Third, whether the infrastructure resurfaces: the domains and the Plerdy vector are disrupted, but the exploit kits behind them are not.

Frequently asked questions

What is the APT29 Poisoned Source campaign?
A watering hole campaign discovered by Sekoia in mid-October 2026 and published on November 4. Attackers poisoned legitimate websites, built lookalike domains and hijacked the Plerdy web analytics service so that unpatched iPhones and Android phones were silently served exploit chains. Sekoia attributes it with moderate to high confidence to APT29.

Am I at risk if my phone is fully updated?
No. Every flaw in the three chains had already been patched, and Sekoia states that a user running an up-to-date operating system is safe. The risk falls on devices running older, unpatched software.

How does a watering hole attack work?
Instead of targeting a victim directly, attackers compromise websites the victim is likely to visit. Opening a poisoned page lets malicious code profile the device and serve a matching exploit chain — in this case with no tap, download or warning required.

What should organisations do before November 18, 2026?
Confirm every Apple device is patched for CVE-2024-27834, which CISA added to its Known Exploited Vulnerabilities catalog on November 4 with a November 18 deadline for US federal agencies. Audit unmanaged devices and review third-party scripts on any website you operate.

Sources

• The Hacker News: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
• Help Net Security: Russian hackers target iOS and Android users with n-day exploits
• CISA: Known Exploited Vulnerabilities Catalog
• Cyware: Daily Threat Intelligence – November 04, 2026