---
title: Hunt: APT29 'Poisoned Source' watering holes served iOS (DarkSword) and Android Chrome exploit chains through hacked sites, lookalike domains and the Plerdy analytics script | ctxsec
url: https://ctxsec.com/items/hunt-sekoia-apt29-poisoned-source-plerdy-watering-hole-darksword-androsnitch
description: "Sekoia found a large watering-hole campaign it attributes to APT29 with moderate to high confidence. It used three entry points: JavaScript injected into legitimate sites, lookalike domains, and a compromise of the Ukrainian web analytics service Plerdy SEO Tracker. A fingerprinting script then served older, already-patched exploit chains with no user interaction: iOS 16.7 (CVE-2025-43529, CVE-2024-27834) for Safari cookies; iOS 18.5 via the DarkSword kit for near-full device data (messages, WhatsApp/Telegram databases, Keychain, photos, health); and Android Chrome 139\u2013145 except 143 (CVE-2026-3910 plus Adreno CVE-2025-27038) dropping AndroSnitch for Chrome cookies, logins and Wi-Fi passwords. Nothing persists after the data is sent."
status: "confirmed research (Sekoia TDR, Nov 4; APT29 attribution moderate to high confidence)"
published: 2026-11-04
---

> Sekoia found a large watering-hole campaign it attributes to APT29 with moderate to high confidence. It used three entry points: JavaScript injected into legitimate sites, lookalike domains, and a compromise of the Ukrainian web analytics service Plerdy SEO Tracker. A fingerprinting script then served older, already-patched exploit chains with no user interaction: iOS 16.7 (CVE-2025-43529, CVE-2024-27834) for Safari cookies; iOS 18.5 via the DarkSword kit for near-full device data (messages, WhatsApp/Telegram databases, Keychain, photos, health); and Android Chrome 139–145 except 143 (CVE-2026-3910 plus Adreno CVE-2025-27038) dropping AndroSnitch for Chrome cookies, logins and Wi-Fi passwords. Nothing persists after the data is sent.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-sekoia-apt29-poisoned-source-plerdy-watering-hole-darksword-androsnitch.md)

confirmed research (Sekoia TDR, Nov 4; APT29 attribution moderate to high confidence)

2026-11-04

### Hunt: APT29 'Poisoned Source' watering holes served iOS (DarkSword) and Android Chrome exploit chains through hacked sites, lookalike domains and the Plerdy analytics script

- **Network:** fingerprinting host `static[.]flux-telemetry[.]com`; exfiltration to `ad.starx-net[.]com:8881/telemetry/v12`. Search proxy, DNS and MDM logs.
- **Web properties:** if your sites load the Plerdy tracker, check what script was served during the campaign window and review it against a known-good copy.
- **Hashes (Android chain):** v139–v144 payload `ae3241d96cc2d99538c7aff60f382cc8dac13859bcbea3ee84992d24d22a8108`; v145 `41e6fd33a30d36dabff9ea408d9766a6583edcc107968f6dc1499f2586381967`; AndroSnitch `387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c`. More in Sekoia's report.
- **Fix:** every chain targets old builds. Enforce minimum iOS and Chrome versions through MDM, and treat phones of at-risk staff that were on old versions as possibly exposed: revoke web sessions and rotate passwords stored on them.

Sources: [Sekoia: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits (Nov 4)](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) · [Help Net Security: Russian hackers target iOS and Android users with n-day exploits](https://www.helpnetsecurity.com/2026/11/04/apt29-watering-hole-mobile-devices-n-day-exploits/)