APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

Sekoia researchers have uncovered "Poisoned Source," a sprawling watering-hole operation attributed to the Russia-linked group APT29 that combines hacked legitimate sites, lookalike domains, and a supply-chain breach of the Ukrainian analytics tool Plerdy SEO Tracker to plant malicious JavaScript. The script fingerprints visiting devices and then routes iOS users to exploit chains abusing flaws such as CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to install the DarkSword kit, while Android users running Chrome 139–145 (excluding 143) are hit via CVE-2026-3910 and CVE-2025-27038 to drop the AndroSnitch payload. Targets have included chemical-industry trade groups, a European far-right party, and Bulgarian military sites, suggesting a focus on high-value, war-related individuals, with stolen cookies, Wi-Fi credentials, and in some cases full device data sent to a remote server — notably sparing Samsung Galaxy S25 Ultra devices. The campaign underscores wider abuse of leaked commercial exploit frameworks like Coruna and DarkSword, also seen recently in separate malvertising and "DeadTag" expired-domain operations hitting unpatched iPhones.