Russia-Linked APT29 Poisons Web Analytics Tool to Target iPhone and Android Users

The Russia-linked threat actor known as APT29 is believed to be behind a large-scale watering hole campaign aimed at iOS and Android users. Sekoia, a French cybersecurity company, discovered the activity in mid-October 2026 and named it Poisoned Source. The attackers used compromised websites, fake domains and a supply chain attack involving Plerdy SEO Tracker, a Ukrainian web analytics service.

According to Sekoia, the injected JavaScript collects browser and device details, then the attackers' infrastructure delivers an exploit chain for either iOS or Android. These are known as N-day exploits, meaning they target flaws that are already known. For iPhone users, the path leads to an exploit kit called DarkSword, which harvests cookies and full device data. On Android, the malware steals Chrome data and Wi-Fi passwords without establishing persistence.

Affected sites included a U.S. chemical industry trade association, a far-right European political party and a Bulgarian military-related website. Sekoia says it is unclear whether specific visitors were targeted or whether the aim was to compromise as many unpatched phones as possible and sort the data later. Several sites are likely to attract high-value visitors in the context of the Russia-Ukraine war.