Sekoia Ties iPhone and Android Spy Campaign to APT29
Sekoia's 'Poisoned Source' report says compromised sites and a tampered Plerdy analytics script pushed exploit code to visitors' devices.
Security firm Sekoia published research titled "Poisoned Source" on November 4, linking a mobile espionage campaign to APT29 or a subordinate group with medium-to-high confidence, dailysecu.com reported.
According to Sekoia, attackers delivered exploit code to visitors' iPhone and Android devices through compromised legitimate websites and a tampered web analytics script. The modified Plerdy tracking script, from Ukrainian analytics provider Plerdy, ran from August 27, 2026 to September 3, 2026.
On iOS, one attack chain used CVE-2025-43529 and CVE-2024-27834 to attempt cookie theft. A second chain, against iOS 18.5, used an exploit set called DarkSword that combined five vulnerabilities, including CVE-2026-20700, to collect SMS messages, WhatsApp and Telegram databases, stored credentials, location data and photos.
The Android component exploited Chrome vulnerability CVE-2026-3910 and an Adreno graphics driver flaw, CVE-2025-27038. The resulting malware, AndroSnitch, was built to collect Chrome cookies, saved logins, browsing history and Wi-Fi passwords.
Sekoia said every attack chain it analyzed relied on vulnerabilities vendors have already patched and does not work on fully updated devices.
Quick answers
Are updated iPhones and Android phones affected by this campaign?
Sekoia said all analyzed attack chains used already-patched vulnerabilities and do not work on fully updated devices.
How was the attack delivered?
Through compromised legitimate websites and a tampered Plerdy web analytics script active from August 27 to September 3, 2026.
What did the Android malware collect?
AndroSnitch was designed to collect Chrome cookies, saved logins, browsing history and Wi-Fi passwords.