APT29 Hijacks Analytics Script to Hack Unpatched Phones

Russia's APT29 used hijacked websites, cloned pages and a tampered third-party analytics script to push exploit chains for already-patched flaws onto iPhones and Android phones, according to a report French security firm Sekoia published on November 4, 2026. Sekoia, which found the operation in mid-October and named it Poisoned Source, said the payloads stole browser cookies and, depending on the device, saved Wi-Fi passwords or nearly the full contents of the phone. It linked the activity to APT29, the group widely attributed to Russia's SVR foreign intelligence agency, with moderate to high confidence. Every flaw involved had been fixed by its vendor before the campaign started.

The trail began with one line of injected JavaScript in the main template of a Ukrainian gas producer's website. Once the page loaded, it pulled a second script from an attacker server. Sekoia then found other altered sites, among them a trade body for American chemical makers, the site of a European far-right party and a military-related site in Bulgaria. On that Bulgarian site, the code sat inside an existing JavaScript library. Where the operators could not break in, they built reverse proxies. One imitated the America250 anniversary site and another posed as Raffles London at The OWO, a hotel near the UK Ministry of Defence. Both relayed the real pages and inserted the malicious code in transit.

Plerdy, a Ukrainian SEO and analytics service whose tracker loads on thousands of mostly Ukrainian sites, gave the attackers their widest reach. From August 27 to September 3, 2026, they modified Plerdy's hosted click-tracking file so each visitor's browser fetched both the genuine tracker and the attackers' profiling script. Sekoia said affected sites included pages run by the Ukrainian army, special forces and makers of ballistic and drone equipment. The firm could not tell whether the operators wanted particular visitors or harvested every unpatched phone they could and sorted the data later.

The profiling script, which its authors called UltimateFingerprinter, ran 61 collectors and built 394 fields describing each device. Sekoia found it bolted onto a minified copy of the AngularJS library, which made up about 98% of the 2.3 MB file, possibly to pass as ordinary library code or to overflow AI tools used for automated triage. Only screen size and touch support decided whether a visitor got an exploit.

Three chains followed. iPhones on iOS 16.7 received CVE-2025-43529, a JavaScriptCore memory flaw, paired with CVE-2024-27834, a pointer authentication bypass Manfred Paul demonstrated at Pwn2Own Vancouver and Apple fixed in iOS 17.5 in May 2024. That chain only took cookies, which can let an intruder replay logged-in webmail sessions. Phones on iOS 18.5 got DarkSword, a five-bug chain that reached the kernel and copied messages, mail indexes, WhatsApp and Telegram databases, Keychain entries, location caches, health records and photos. On Android, Chrome builds 139 to 145, minus 143 for reasons Sekoia could not explain, drew a V8 bug, CVE-2026-3910, chained with CVE-2025-27038 in Qualcomm's Adreno GPU driver.

The patch history shows how far behind those devices were. Apple fixed CVE-2025-43529 in iOS 26.2 and iOS 18.7.3 in December 2025, crediting Google's Threat Analysis Group (TAG) and citing exploitation against targeted individuals. The dyld flaw CVE-2026-20700 closed with iOS 26.3 on February 11, 2026. Google patched CVE-2026-3910 in an emergency Chrome 146 release on March 12, 2026, and CISA added it to its Known Exploited Vulnerabilities catalog the next day. Qualcomm shipped the Adreno fix to handset makers in May 2025, leaving Android owners dependent on their manufacturer to deliver it. When Plerdy was compromised, the newest bug in the set had been public for more than five months.

For attribution, a CERT partner found leftovers on one compromised server matching a 2025 APT29 watering hole operation. TAG told Sekoia the framework resembled one APT29 turned on Mongolian government sites, which TAG documented in August 2024 as relying on exploits that matched or closely tracked code first used by spyware vendors Intellexa and NSO Group. Sekoia named its Android stealer AndroSnitch after TAG's ANDROSNATCH. The iOS 16 delivery server also served only version 16.7, though the exploit should work through 17.4, a mismatch Sekoia read as reuse of someone else's code. Google reported in March 2026 that DarkSword had circulated among several spyware vendors and suspected state actors since at least November 2025.

The incident underscores that a vendor patch protects nobody until it reaches the phone, and that one compromised third-party script can turn trusted websites into delivery points. Auditors at banks and insurers should confirm that MDM blocks devices below a minimum iOS and Android build from email and corporate apps, that mobile patch SLAs run from the vendor release date, and that Android exceptions are tracked by manufacturer patch level. Web teams should inventory external scripts, pin static libraries with Subresource Integrity, restrict script sources through Content Security Policy, and put analytics and tag vendors through third-party risk review. Google advises Lockdown Mode for iPhones that cannot be updated, and TAG reported in 2024 that Lockdown Mode blocked APT29's earlier iOS exploit, so it belongs on phones carried by executives traveling to high-risk regions.