[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (Sekoia TDR, Nov 4; APT29 attribution moderate to high confidence)

Hunt: APT29 'Poisoned Source' watering holes served iOS (DarkSword) and Android Chrome exploit chains through hacked sites, lookalike domains and the Plerdy analytics script

  • Network: fingerprinting host static[.]flux-telemetry[.]com; exfiltration to ad.starx-net[.]com:8881/telemetry/v12. Search proxy, DNS and MDM logs.
  • Web properties: if your sites load the Plerdy tracker, check what script was served during the campaign window and review it against a known-good copy.
  • Hashes (Android chain): v139–v144 payload ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108; v145 41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967; AndroSnitch 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c. More in Sekoia's report.
  • Fix: every chain targets old builds. Enforce minimum iOS and Chrome versions through MDM, and treat phones of at-risk staff that were on old versions as possibly exposed: revoke web sessions and rotate passwords stored on them.

Sources: Sekoia: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Nov 4) · Help Net Security: Russian hackers target iOS and Android users with n-day exploits