APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
Summary: Sekoia researchers attribute a watering hole campaign, codenamed Poisoned Source and discovered in mid-October 2026, to APT29, using compromised websites, fake domains, and a supply chain attack on Ukrainian web analytics service Plerdy SEO Tracker to serve platform-specific N-day exploit chains to iOS and Android visitors. The injected JavaScript profiles browser and device attributes, then delivers DarkSword to iOS and AndroSnitch to Android, with exfiltrated data sent to the endpoint ad.starx-net[.]com:8881/telemetry/v12.
Bottom line: Compromised sites in the campaign include a U.S. chemical industry trade association, a far-right European political party, and a Bulgarian military-related website, and Sekoia notes the Android chain aborts if the device is a Samsung Galaxy S25 Ultra (SM-S938B) - a sign of deliberate device selection rather than indiscriminate targeting.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-4671CVE-2024-5274
- Related
- CVE-2024-5274: Google Chromium V8 Type Confusion Vulnerability Known Exploited Vulnerabilities · May 28, 2024CVE-2024-4671: Google Chromium Visuals Use-After-Free Vulnerability Known Exploited Vulnerabilities · May 13, 2024University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026