On 4 November 2026 the security firm Sekoia published research on a campaign it calls "Poisoned Source": websites were tampered with so that phones visiting them were profiled and, if vulnerable, hit with exploit chains. Sekoia found it in mid-October and attributes it, with moderate to high confidence, to APT29, the group widely linked to Russia's SVR intelligence service.
The supply-chain part: from 27 August to 3 September 2026, the attackers changed the script of Plerdy, a Ukrainian web analytics and SEO tracker. Every site loading it also loaded the attackers' fingerprinting script. Sekoia says the tracker is used by thousands of websites, mostly Ukrainian, including army, special forces and military equipment sites (its report also says "hundreds" in one place). The attackers also injected JavaScript directly into legitimate sites, among them a Ukrainian gas production company, a US chemical industry trade association, a European far-right party and a Bulgarian military-related site, and ran two lookalike domains that proxied real sites.
What the exploits did: Sekoia recovered three chains. One targeted iOS 16.7 and stole cookies; a second, based on the DarkSword kit, targeted iOS 18.5 and took messages, mail, WhatsApp and Telegram data, Keychain items, photos, location and more; a third targeted Chrome 139–145 on Android and stole Chrome cookies, saved logins, history and Wi-Fi passwords. They used flaws such as CVE-2025-43529 and CVE-2024-27834 on iOS and CVE-2026-3910 on Android.
All of these flaws were already patched before the campaign, and Sekoia says up-to-date devices are safe. The malware did not stay on the phone after a reboot (no persistence). Victims were mainly in Ukraine but also in the US, the Czech Republic, Bulgaria and elsewhere in Europe; Sekoia even saw an Australian medical clinic's site involved. Sekoia says it is working with national CERTs on victims and infrastructure.
