Sekoia links APT29 to watering holes that served patched mobile exploits with no click needed
Sekoia uncovered the campaign in mid-October 2026. Plerdy's tracker was used by thousands of mostly Ukrainian sites and was compromised for one week.
By Ryan Merket · Published
Primary source: www.sekoia.com
Why it matters
Poisoned Source shows that patched mobile flaws stay useful to state actors when devices lag on updates, and that a single compromised analytics script can turn thousands of unrelated websites into exploit delivery points.
Sekoia's Threat Detection & Research team said on November 4th that a group it links to APT29 used compromised websites, lookalike domains and a hijacked Ukrainian analytics script to deliver mobile exploit chains to iPhone and Android visitors. The French cybersecurity company uncovered the campaign, which it calls Poisoned Source, in mid-October 2026 and assessed with moderate to high confidence that APT29 conducted it.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.