APT29-Linked Hackers Hijacked an Analytics Script to Hit Phones

The exploits were old. The delivery route was a marketing script. On November 4, French security firm Sekoia detailed Poisoned Source, a watering hole campaign it links to Russia’s APT29 with moderate to high confidence. The attackers hijacked a Ukrainian web analytics tracker for a week and used it to push iOS and Android exploit chains at visitors. The Hacker News covered the findings, and every flaw involved already has a patch.

ماذا حدث؟

‼️APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users

Details: https://t.co/PkHiWhkHYK

A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy… pic.twitter.com/RlRaPDg9Nr

— Cyber Security News (@The_Cyber_News) November 5, 2026

A watering hole attack compromises sites its targets already visit. Sekoia spotted this operation in mid-October and found three delivery routes. Attackers injected scripts into legitimate websites, built lookalike domains that imitate high-profile sites in the US, Ukraine, the Czech Republic, and Bulgaria (one US-facing lookalike used america250[.]holiday), and compromised the Plerdy SEO Tracker between August 27 and September 3. The injected sites included a US chemical industry trade association, a European political party, and a Bulgarian military-related site.

Plerdy loads on thousands of mostly Ukrainian websites, and Infosecurity Magazine reports that the week-long compromise exposed hundreds of them. Sekoia says the supply chain route reached high-value visitors, including people browsing army, special forces, and military equipment sites. It could not say whether the attackers wanted specific people or as many unpatched phones as possible.

What did the exploits steal?

A JavaScript loader profiles each visitor’s browser and device, then serves a matching exploit chain. Sekoia identified three:

• iOS 16.7: CVE-2025-43529 and CVE-2024-27834 steal browser cookies.
• iOS 18.5: the five-flaw DarkSword chain takes full device data, including messages, WhatsApp and Telegram databases, the iCloud Keychain, Wi-Fi passwords, photos, and Safari history.
• Android, Chrome 139 to 145 (excluding 143): CVE-2026-3910 and CVE-2025-27038 give code execution and root access, then a payload called AndroSnitch collects Chrome data and Wi-Fi passwords. It stops if the phone is a Samsung Galaxy S25 Ultra.

All three chains send stolen data to the same server, starx-net[.]com, and Sekoia found no persistence on the device.

Why does this matter beyond APT29?

Sekoia’s analysis supports the idea that APT29 obtained the exploits from a third party. The group has done this before: Google documented a suspected APT29 watering hole against Mongolian government sites in August 2024, and AndroSnitch takes its name from that campaign’s ANDROSNATCH payload. DarkSword and Coruna are now commodity kits, and Zimperium counted 608 domains serving Coruna-family code in October. Sekoia warns that packaged n-day chains lower the cost and skill needed for advanced mobile exploitation.

The delivery trick is not unique to a state actor either. Report URI’s DeadTag research found more than 660 expired domains behind forgotten analytics and advertising tags, still loaded by thousands of sites and feeding the same kits to iPhone visitors. Two very different operators found the same weakness: scripts your pages load and nobody owns.

That pattern keeps repeating. We covered a similar third-party script hijack at Adform in our July 27 roundup, and our October 26 roundup made the same point about the Brotli flaw, a component your asset register never lists. Our 2026 Supply Chain Cyber Risk Report puts the average organization at 286 vendors. State-linked espionage also hides well: in our Russia-Ukraine report, initial access claims make up just 3.4% of recorded activity, and our analysis of APT28’s router hijacking campaign shows another Russian actor working through infrastructure nobody was watching.

Treat the attribution as a confidence level, not a verdict. Sekoia assesses APT29 with moderate to high confidence, and CISA and Apple have not attributed the activity.

What you need to do now

1. Patch phones and browsers. CVE-2024-27834 has had a fix since May 2024, in iOS 17.5 and iOS 16.7.8. CISA added it to the Known Exploited Vulnerabilities catalog on November 4 with a federal deadline of November 18. It carries a CVSS score of only 5.5, which shows how little a score tells you about who is using a flaw. Use your MDM to list devices still on iOS 16.7, iOS 18.5, or Chrome 139 to 145, the versions these chains target.
2. Audit the scripts your sites load. List every third-party tag, remove the abandoned ones, and check whether any of your pages loaded Plerdy between August 27 and September 3.
3. Watch for lookalikes. Poisoned Source used domains that imitate well-known sites. Brand Protection detects and takes down malicious domains that impersonate your organization.
4. Map exposure beyond your own domains. Attack Surface Management extends your perimeter to partners and suppliers, and our Miasma analysis shows how warning signs appeared seven weeks before a supply chain attack executed.

Sekoia’s bottom line is that an up-to-date device is safe from these chains. The harder question is which of your pages hands attackers a path to the devices that are not.