On a quiet autumn day, a person might visit a hotel's website or a national anniversary page and see nothing amiss, while beneath the surface a script weighs what kind of device they carry. Researchers at Sekoia have traced a campaign they call Poisoned Source, which slipped exploit code onto iPhones and Android phones through hijacked sites and a compromised analytics tool, and which they link with moderate to high confidence to the Russian SVR-associated group APT29. The harm worked on patches that already existed, so the danger lay less in a new weakness than in the lag between a fix and th
Russia-Linked Hackers Turned a Hijacked Analytics Script Into a Phone Spy Tool, Sekoia Says
Visitors' phones were targeted for theft of cookies, Wi-Fi credentials, and in some iOS cases full device data including messages, photos, and health records.
Simply opening the page is enough for your device to be compromised.
Mark
Start with the basics. Why does this campaign matter if every flaw was already patched?
Mimi
Because patched doesn't mean fixed everywhere. Anyone on an outdated iOS or Chrome version was exposed just by loading a page. No click, no download.
Mark
And the delivery trick was the analytics script?
Mimi
One of three routes. Sekoia says Plerdy SEO Tracker's script file was tampered with between Aug. 27 and Sept. 3, serving thousands of sites. They also breached sites directly and built lookalike domains.
Luke
Let me flag the attribution. Sekoia says moderate to high confidence in APT29. That's an assessment, not a confirmation.
Mark
Fair. What about the targets, like the London hotel?
Mimi
The fake OWO site and the America250 clone suggest invitation-themed lures for diplomats and guests. The Zelenskyy stay on Oct. 14 comes from open-source reporting.
Luke
Right, and that's the researchers' suggestion about intent. The report doesn't show anyone from that visit was infected. We also don't know how many victims there were at all.
Mark
Any loose ends?
Mimi
The Samsung Galaxy S25 Ultra exclusion. The code aborts on that model, and the researchers didn't explain it.
Luke
Which means anyone offering a reason is guessing. Same for who ran DarkSword here; Google linked it to other customers, not necessarily this group's source.
Mimi
What's solid is the advice: update your phone and browser.
O Pulso
- A single page load, with no click required, could quietly search a phone for its secrets.
- Compromised sites, lookalike domains, and a tainted SEO script formed three doors into the same hidden loader.
- Decoy pages mimicking an American anniversary site and a London luxury hotel suggest diplomats and defense-linked visitors were the intended targets.
- Exploit chains built on already-patched flaws reached iOS 16.7, iOS 18.5 and Chrome on Android, with the iOS variant able to pull messages, photos, and health records.
- Only devices left on outdated software were exposed, so keeping iOS and Chrome current is the immediate defense, while the narrow targeting may slow victim notification and complicate attribution.
On a quiet autumn day, a person might visit a hotel's website or a national anniversary page and see nothing amiss, while beneath the surface a script weighs what kind of device they carry. Researchers at Sekoia have traced a campaign they call Poisoned Source, which slipped exploit code onto iPhones and Android phones through hijacked sites and a compromised analytics tool, and which they link with moderate to high confidence to the Russian SVR-associated group APT29. The harm worked on patches that already existed, so the danger lay less in a new weakness than in the lag between a fix and the moment a device is updated. It is a reminder of how much trust is spread across the ordinary web, and how little of it the visitor ever gets to see.
A visitor opens the website of a London hotel or the page for America's 250th anniversary, and everything looks ordinary. The real content loads. Behind it, a script is quietly checking which phone the visitor is holding. Sekoia, a French security firm, has named this campaign Poisoned Source. It detected the operation in mid-October 2026 and attributes it, with moderate to high confidence, to APT29, the group Western governments have long tied to Russia's foreign intelligence service, the SVR.
The operation reached phones on both iOS and Android. It moved through a compromised Ukrainian analytics service, through lookalike domains copying prominent sites in the United States, Ukraine, the Czech Republic and Bulgaria, and through a supply-chain breach in the Plerdy SEO Tracker script, which was poisoned for about a week in late summer. No new flaw was involved. Every vulnerability in the chain already had a patch, so only phones running outdated software were at risk, and the victim needed to do nothing at all. A loader first profiled each device and then served a package built for it. The goal was cookies, Wi-Fi passwords, and, on some iPhones, nearly everything stored on the device, from messages and photos to health records.
The decoys reveal the intended audience. One fake mirrored America250.org, and another proxied a luxury hotel a short walk from the Ministry of Defence and Downing Street, where a Ukrainian president had reportedly stayed weeks earlier. Researchers suggest invitation-themed phishing aimed at delegations and high-profile guests, and several compromised sites drew military and defense-industrial visitors tied to the war in Ukraine. The Android branch held one puzzle: it stood down on a single Samsung model, and Sekoia could not say why.
The lesson Sekoia draws is about cost. When state groups reuse commercial exploit kits, advanced mobile intrusion becomes cheaper and easier to attempt. The practical defense is simple: keep iOS and Chrome updated. Because the targeting is narrow, victims may be notified slowly, and attribution may stay difficult.
A visitor opens the website of a hotel in London, or the page for America's 250th anniversary celebrations, and nothing looks wrong. The real content loads. But behind it, a script is quietly checking which phone the visitor is holding. According to new research from the French security firm Sekoia, that was the mechanism of a campaign it calls Poisoned Source, detected in mid-October 2026 and attributed with moderate to high confidence to APT29, the intrusion set Western governments have long linked to Russia's Foreign Intelligence Service, the SVR.
Sekoia says the operation hijacked mobile browsers on both iOS and Android. It used a compromised Ukrainian web analytics service, lookalike domains and injected scripts to deliver exploit chains. No new flaw was involved. Every vulnerability in the chain was an n-day, meaning a patch already existed, so only phones running outdated operating system or browser versions could be infected. The delivery needed no click from the target. A JavaScript loader profiled each visitor's browser and hardware, then served a package built for that device. Researchers Amaury-Jacques Garçon and Félix Aime wrote that the code collects browser and device attributes before the infrastructure pushes a payload for iOS or Android. The goal was theft of browser cookies and, in some cases, Wi-Fi credentials and full device data.
Three routes fed the same loader. Attackers breached legitimate sites to plant malicious JavaScript. They registered lookalike domains imitating prominent sites in the United States, Ukraine, the Czech Republic and Bulgaria. And they compromised the supply chain of Plerdy SEO Tracker between Aug. 27 and Sept. 3, 2026, inserting code into a script file served to thousands of sites.
The impersonated sites hint at who was wanted. The attackers registered america250[.]holiday, a reverse proxy that pulled genuine content from america250.org, the nonpartisan group organizing the 250th anniversary of American independence, while adding the profiling script. Another fake, theowo[.]club, proxied Raffles London at The OWO, a luxury hotel a short walk from the Ministry of Defence and 10 Downing Street. The researchers suggested this pointed to invitation-themed spear-phishing aimed at diplomatic delegations and high-profile guests, noting open-source reporting that Ukrainian President Volodymyr Zelenskyy stayed there during an Oct. 14 visit. Other compromised sites included a major U.S. chemical industry trade association, a far-right European political party, a Bulgarian military-related website and a leading Ukrainian gas producer. Several, the report said, draw military, special forces and defense-industrial visitors in the context of the war in Ukraine.
Payloads fell into three classes. Class A hit iOS 16.7 using CVE-2025-43529 and CVE-2024-27834, delivering JavaScript malware for cookie theft. Class B hit iOS 18.5 with the DarkSword chain, which combines CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. It allowed full exfiltration: messages, mail databases, voicemail, WhatsApp and Telegram stores, iCloud Keychain, Wi-Fi passwords, contacts, call history, Safari data, photos and health records. Class C targeted Android running Chrome 139 through 145, excluding version 143, using CVE-2026-3910 and CVE-2025-27038 for code execution, sandbox escape and privilege escalation, ending in a stealer called AndroSnitch that takes Chrome data and Wi-Fi passwords.
DarkSword is a commercial iOS exploit kit that Google researchers have tied to customers of the Turkish surveillance vendor PARS Defense and at least two other threat actors. The Android branch had an unexplained quirk: it checked the device model and aborted on a Samsung Galaxy S25 Ultra (SM-S938B). Sekoia did not say why. All stolen data went to one endpoint, ad.starx-net[.]com on port 8881. Sekoia argues that state-backed groups reusing packaged commercial frameworks lowers the cost and skill needed for advanced mobile intrusions, and it noted parallels to a 2024 APT29-linked watering hole on a Mongolian government site and to a Google-documented cookie stealer from that year.
Separately, iVerify, Report URI and Zimperium have tracked DarkSword and a kit called Coruna spreading through criminal channels. Report URI's Scott Helme described a scheme in which expired analytics and advertising domains are re-registered and still loaded by thousands of sites, saying simply opening the page is enough to compromise a device. Zimperium counted 608 domains serving Coruna-family code as of October 2026.
The practical defense is plain: keep iOS and Chrome current, since every flaw has a fix. Because the targeting looks narrow, victim notification may be slow and attribution harder.
Citações Notáveis
Simply opening the page is enough for your device to be compromised. There's nothing to tap, no link to click, nothing to install and no warning.— Scott Helme, Report URI
The injected code collects browser and device attributes before delivery infrastructure pushes an iOS or Android payload.— Sekoia researchers Amaury-Jacques Garçon and Félix Aime (paraphrased)
Quer a matéria completa?
Leia o original em BigGo Finance ↗
Politics & Governance