APT29's 'Poisoned Source': How a Hijacked Analytics Script Turned Millions of Websites Into Mobile Exploit Delivery Networks
Between August and October 2026, the Russia-linked threat actor APT29 conducted a sophisticated multi-vector mobile exploitation campaign dubbed 'Poisoned Source.' Attackers compromised legitimate websites, registered lookalike domains, and injected malicious JavaScript into the Plerdy SEO Tracker supply chain (affecting the widely loaded script at a.plerdy[.]com) to deliver platform-specific N-day exploit chains to iOS and Android users. iOS victims were targeted with the DarkSword exploit kit across CVE-2025-43529, CVE-2026-20700, and related vulnerabilities, enabling full device data exfiltration including iMessages, iCloud Keychain, and Wi-Fi passwords. Android users were served a Chrome-targeting chain exploiting CVE-2026-3910 and CVE-2025-27038, culminating in deployment of the AndroSnitch infostealer. This campaign illustrates the accelerating commoditization of commercial surveillance vendor exploit frameworks. The confirmed reuse of DarkSword across both nation-state and criminal actors, combined with the Coruna kit's broad availability following public disclosure, signals a structural shift: advanced mobile exploitation is no longer exclusive to well-resourced state programs, raising the risk floor for enterprises, government agencies, and critical infrastructure operators globally.
Kill Chain
