APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and Félix Aime said in a technical report shared with The Hacker News. "Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android." The end goal of the attacks is to serve payloads capable of stealing browser cookies, and in some cases, Wi-Fi passwords or full mobile device data. The activity, codenamed Poisoned Source, was discovered by the French cybersecurity company in mid-October 2026. A defining aspect of the campaign is the use of three infection vectors - Compromise of legitimate websites to inject malicious JavaScript Lookalike sites masquerading as high-profile websites in the U.S. ("america250[.]holiday"), Ukraine, Czech Republic, and Bulgaria Supply chain compromise of Plerdy SEO Tracker between August 27 and September 3, 2026, by injecting malicious code into "a.plerdy[.]com/public/js/click/main.js" Some of the compromised websites include a major industry trade association representing U.S. companies operating in the chemical industry, a far-right European political party, and a Bulgarian military-related website. It's suspected that the watering hole campaign may have been designed to target specific individuals rather than a broad effort. "It remains unclear whether the attackers intended to target visitors to specific websites or sought to compromise as many unpatched mobile devices as possible, indiscriminately exfiltrating data before selectively identifying and exploiting information of interest," Sekoia said. "However, several of these sites are likely to attract high-value or strategically important visitors in the context of the Russia-Ukraine war. This supply chain attack spread through high-value targets, such as army, special forces, and military equipment (ballistic, UAV) websites." Regardless of the method employed, all roads lead to the same payload: a JavaScript loader that profiles the visitor's device and web browser, and then serves appropriate next-stage malware. For iOS users, it leads to an exploit kit called DarkSword to harvest cookies and full device data. On Android, the malware is equipped to exfiltrate Chrome data and Wi-Fi passwords without establishing persistence. No less than three different exploits have been identified - Class A, which targets iOS devices running iOS 16.7 and exploits CVE-2025-43529 (the same vulnerability exploited by DarkSword) and CVE-2024-27834 to deliver JavaScript malware for cookie theft. Class B, which targets iOS devices running iOS 18.5 and exploits the DarkSword exploit chain comprising CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to deliver JavaScript malware for full device data exfiltration. This includes SMS messages and iMessages; Apple Mail Envelope Index and Protected Index SQLite databases; voicemail; WhatsApp and Telegram databases; iCloud Keychain, Wi-Fi passwords; contacts; call history; Safari browser history and cookies; photos; and data from Apple Health, Calendar, Notes, and iCloud Drive. Class C, which targets Android devices running Chrome versions from 139 through 145 (but explicitly excluding version 143 for reasons that remain presently unknown) and exploits CVE-2026-3910 and CVE-2025-27038 to achieve remote code execution, sandbox escape, privilege escalation, and ultimately deliver AndroSnitch to collect Chrome data and Wi-Fi passwords. In all three cases, the exfiltrated data is sent to the "ad.starx-net[.]com:8881/telemetry/v12" endpoint. The Android attack chain incorporates a check to determine whether the targeted device is a Samsung Galaxy S25 Ultra by examining its model identifier (i.e., SM-S938B). If the device matches, the exploitation activity is terminated. AndroSnitch derives its name from its similarities to ANDROSNATCH, a Chrome cookie-stealing payload that Google documented in August 2024 in connection with a suspected APT29 watering hole campaign, which targeted Android users visiting a Mongolian government website by leveraging a Chrome exploit chain involving CVE-2024-5274 and CVE-2024-4671. "This operation also confirms the continued reuse of CSV [Commercial Surveillance Vendors] mobile exploit frameworks, such as DarkSword, by state-sponsored intrusion sets," Sekoia said. "The adoption of packaged N-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation." The development comes weeks after iVerify and Report URI detailed the P7 variant of DarkSword being delivered via half-click attacks that leverage ad-based infrastructure. In one case, the exploit is said to have been propagated through a malicious Instagram ad themed around the World Cup and served from "ad-track[.]live." The other pathway is part of a criminal campaign dubbed DeadTag, in which attackers acquire expired domains behind old analytics and advertising tags that are still loaded by thousands of websites. The idea is to serve malicious JavaScript to iPhone visitors and silently do the attacker's bidding. "It checks who's visiting," Report URI said. "Search engines, security scanners, automated browsers and anything else that looks like a bot gets nothing." The script then interacts with the attacker's server, which then decides the destination to which each visitor has to be redirected. The iPhone exploit paths that take advantage of DeadTag lead to the Coruna exploit kit for older iPhones running iOS version 13 to 17.2.1 and DarkSword P7 for iOS devices running 18.4 to 18.7. "These are not phishing pages or fake app downloads, both kits attack the browser itself," Report URI's Scott Helme said. "Simply opening the page is enough for your device to be compromised. There's nothing to tap, you don't need to click any link, nothing to install and no warning. If the iPhone is running a vulnerable version of iOS, the kit breaks out of the browser and installs spyware on the device." Other schemes lead to decoy Google redirects, betting and casino scam sign-up pages, search advertisements for car deals and dentists, and fake surveys and "you've won" prize pages. More than 660 expired and re-registered domains are part of the DeadTag network. According to an analysis published by Zimperium zLabs, campaigns distributing Coruna and DarkSword exploit kits have continued to evolve, with 608 domains delivering Coruna-family code as of October 2026. Although Coruna was initially developed by a nation-state actor for highly targeted operations, its subsequent leak following initial disclosure has made the toolkit widely accessible to multiple threat actors for their own campaigns. In many cases, the lure sites have been found to explicitly instruct visitors to exit their in-app browser or alternative iOS browser and open the link in Safari so as to trigger the exploit chain depending upon the device operating system. "Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework (exhibiting byte-identical JavaScript payloads across multiple recovered configurations)," security researcher Santiago Rodriguez said. "Conversely, devices running later iOS builds receive a DarkSword-derived execution chain." "The analyzed distribution footprint spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and – in several instances – compromised legitimate sites serving the kit via hidden iframes." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, Malware, mobile security, Nation-State, Supply Chain, Vulnerability, Web Security Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories AI-Generated Fake Login Pages Are Making Account Takeovers Easier Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security