One route in an APT29-linked phone-exploit campaign was a hijacked tracker

A company can patch every server it owns and still hand its visitors to an attacker. The route is the small analytics tag sitting in the page. It runs in each visitor's browser, and it carries the site's good name with it.

That is the lesson of a campaign Sekoia calls Poisoned Source. The lesson is the publication's reading. The facts below are Sekoia's.

What Sekoia found

Sekoia's Threat Detection & Research team uncovered a large watering hole campaign in mid-October 2026. A watering hole is a trap set on sites that targets are likely to visit. The sites involved were compromised or cloned, and they sat in the US, Ukraine, the Czech Republic and Bulgaria.

Sekoia assesses with moderate to high confidence that APT29 is behind it. That is a Russian group widely linked to the country's Foreign Intelligence Service. It is an assessment, not a proven attribution.

The group used three routes. It injected JavaScript directly into legitimate websites. It built lookalike domains that relayed the real site's pages and added a malicious script on the way through. Two examples were a copy of America250.org and a copy of the website for Raffles London at The OWO.

The third route is the one executives should study. Between 27 August and 3 September 2026, Sekoia says, the group compromised a tracker hosted by Plerdy, a Ukrainian web analytics service. Thousands of websites load it, most of them Ukrainian. Sekoia says hundreds of legitimate sites and their visitors were exposed for that week.

Sekoia could not say whether the attackers wanted specific visitors or as many unpatched phones as possible. It did note that some affected sites, such as military equipment pages, would draw valuable visitors in the context of the war in Ukraine.

How the attack works

All three routes load one script, which Sekoia calls UltimateFingerprinter. It reads the visitor's operating system and browser version. It also gathers a detailed profile of the device, from 61 collectors that build 394 fields. The server then returns an exploit chain that matches the device. The visitor clicks nothing.

The profiling did less than it seems. Sekoia found that only three values could block delivery, such as a screen size of 99999 or a device reporting no touch points. Sekoia says the purpose of the rest is unclear.

The script was also hidden inside a 2.3 MB copy of the AngularJS library, and roughly 98% of that file was dead code. Sekoia believes this may slow automated analysis by exceeding the context window of large language models, or make the file look legitimate.

The payloads take a great deal. Sekoia says the iOS chain it calls DarkSword collects messages, WhatsApp and Telegram databases, Keychain passwords and tokens, Wi-Fi passwords and photos. One iOS chain exploits CVE-2025-43529. The Android chain targets Chrome 139 to 145, skipping 143, and uses CVE-2026-3910 and CVE-2025-27038. It steals Chrome data and Wi-Fi passwords. Sekoia says none of the payloads sets up persistence.

Old flaws, trusted delivery

Sekoia states that all three chains rely on known, already-patched vulnerabilities. It says none contains a zero-day or works against fully updated devices. Each flaw was fixed before the campaign began.

Sekoia also says packaged n-day chains lower "the cost and technical threshold" of advanced mobile attacks. Its analysis of the delivery logic points to exploits bought or borrowed rather than built by the operators. One example is a server filter that accepts only iOS 16.7, though the exploit works on 16.0 to 17.4.

Put the facts together. The attacker did not need a secret flaw. It needed a place that visitors already trusted, and phones that were behind on updates. The tracker supplied the trust on one route. The unpatched phone supplied the opening.

This shows two budgets that are usually kept apart. The web team owns the page and the vendors it loads. The IT team owns the phones. This campaign ran through the gap between them.

Questions to put to your teams

Ask the web team for a list of every third-party script on your public sites. For each one, ask who approved it, what it can read, and whether it is still needed. A tag that nobody can justify is a candidate for removal.

Ask IT for the oldest iOS and Chrome versions on staff and executive devices. Sekoia says one chain works from iOS 16.0 to 17.4 and the Android chain covers Chrome 139 to 145. Ask how long an update takes to reach every phone.

Ask your security team how quickly a compromised vendor script would be noticed. The tracker window closed in early September. Sekoia says it uncovered the campaign in mid-October, about six weeks later.

Patching the phone and trimming the page are the same decision seen from two sides: the less you leave outdated or unexamined, the less an attacker can borrow.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Sekoia.