Summary
- Sekoia attributes the Poisoned Source campaign to APT29 or a subgroup with moderate-to-high confidence.
- Attackers used compromised websites, imitation domains, and a modified Ukrainian analytics script.
- The exploit chains targeted previously patched vulnerabilities, and the number of compromised devices remains unknown.
A suspected Russian cyberespionage campaign has used compromised websites and a third-party analytics service to deliver exploits against outdated iPhones and Android devices, potentially exposing authentication data and other information stored on affected handsets.
French cybersecurity company Sekoia identified the campaign, named Poisoned Source, during October and published its findings on 4 November 2026.
The researchers attributed the activity to APT29, or a related subgroup, with moderate-to-high confidence. APT29 is widely associated with Russian intelligence operations, although Sekoia’s assessment does not independently establish the identity of the individuals conducting this campaign.
The operation used three delivery methods: malicious scripts inserted into legitimate websites, imitation domains designed to resemble established sites, and a compromise affecting Plerdy, a Ukrainian web analytics service.
Affected web properties included sites associated with Ukrainian industry and military interests, as well as organisations in Bulgaria, the Czech Republic, and the United States. Researchers also identified imitation domains referencing a London hotel and the America250 initiative.
The Plerdy component was compromised between 27 August and 3 September, potentially exposing visitors to websites using the affected analytics script. Sekoia has not established how many mobile devices were successfully compromised.
Previously patched vulnerabilities supplied the exploit routes
Visitors encountering the malicious JavaScript were profiled to establish their device and browser characteristics. The delivery infrastructure could then supply an exploit chain corresponding to the detected software.
Researchers recovered three principal chains targeting different iOS and Android configurations. The operation relied on vulnerabilities that had already been disclosed and patched rather than previously unknown flaws.
One iPhone chain targeted older iOS 16 configurations and attempted to obtain browser cookies. Another used the DarkSword exploit kit against iOS 18.5, with capabilities described by researchers as extending to messages, authentication information, and other device data.
The Android chain targeted selected versions of Chrome and sought browser information and stored wireless-network details.
These capabilities differ between chains, and the existence of an exploit does not establish that every visitor received a payload or that an attempted infection succeeded.
Sekoia reported that the recovered payloads did not establish persistence. However, that finding does not determine whether any stolen authentication sessions remained usable after the initial device activity ended.
Third-party scripts complicate website assurance
Analytics services are routinely incorporated into websites through externally supplied JavaScript. The arrangement enables publishers and businesses to add functionality without maintaining all of the underlying code themselves.
It also introduces a dependency on the integrity of the provider’s distribution systems. When a shared script is modified maliciously, visitors can encounter hostile code while browsing a website whose own content and administrative systems remain otherwise legitimate.
The Plerdy compromise is particularly relevant because a single analytics component could be loaded by numerous unrelated websites. Exposure through the component should not be confused with confirmed compromise of every site or device that encountered it.
Mobile devices increasingly carry business communications, authenticated cloud sessions, and access to enterprise applications. Theft of session cookies can create opportunities for account misuse even where a password is not directly obtained.
The practical exposure depends on the applications involved, whether stolen sessions remain valid, and the security controls applied by the services accepting them.
The campaign also illustrates the consequences of delayed mobile patch deployment. Organisations can operate supported mobile fleets while still retaining devices with outdated operating systems or browser builds, particularly where ownership and update responsibility are divided between employees and employers.
Sekoia said all vulnerabilities used in the observed chains had received fixes before the campaign. The researchers have not established the number of successful infections, the full extent of any information theft, or a confirmed identity for the operators.
