Sekoia detailed Poisoned Source, a campaign targeting mobile users via compromised websites and third-party tracking scripts.
Linked to APT29, the operation inspected device and browser environments to deliver targeted payloads against iOS and Android devices.
The attackers used compromised legitimate websites and deceptive websites. They also compromised Plerdy SEO Tracker, a tool that had malicious code from August 27 to September 3, 2026.
Among the websites affected were a major American chemical industry trade association, a far-right European party, and a website related to the Bulgarian military. According to Sekoia, some of these pages may have attracted visitors of strategic importance in the context of the Russia-Ukraine war. It has not been confirmed whether the perpetrators chose them for this reason.
The attack checked device and browser data to select the appropriate malware. On iPhones running iOS 16.7, it was able to steal data stored by the browser.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Criminals changed blood freezer settings in France, setting their target temperature to 110°C
↗
On iPhones with iOS 18.5, it could collect more data: SMS and iMessages, contacts, call and browsing history, photos, Wi-Fi passwords, as well as data from WhatsApp and Telegram.
On Android, the attack targeted Chrome versions 139 to 145, except version 143. It could collect Chrome data and Wi-Fi passwords. Researchers don't know why version 143 was excluded.
The attack also stopped if it recognized a Samsung Galaxy S25 Ultra.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)