Russia-linked cyberespionage hackers have compromised a legitimate web analytics script to distribute sophisticated spyware targeting Apple iOS and Google Android devices. The campaign, named Poisoned Source, uses malicious JavaScript injected into trusted websites to identify visitors' devices and deliver exploits designed to steal sensitive information.
The operation has been linked to APT29, a cyberespionage group associated with Russia's Foreign Intelligence Service (SVR). According to cybersecurity researchers, the attackers abused a third-party web analytics service to reach visitors of legitimate websites without requiring them to download suspicious applications or files.
Attackers use three infection methods
According to Sekoia researchers Amaury-Jacques Garçon and Félix Aime, the campaign relied on three main methods to infect devices. These included compromising legitimate websites, creating fake websites that impersonated well-known organisations, and conducting a supply-chain attack against Plerdy SEO Tracker.
The supply-chain compromise took place between August 27 and September 3, 2026. During this period, attackers injected malicious code into the JavaScript file hosted on Plerdy's infrastructure. Since the analytics script was used by thousands of websites, the compromise potentially exposed a large number of visitors to the malicious code.
The researchers discovered that the attackers also created lookalike websites impersonating organisations in the United States, Ukraine, the Czech Republic and Bulgaria. Some compromised websites were associated with the chemical industry, political organisations and military-related activities.
Exploits target iOS and android devices
Once the malicious JavaScript executes, it collects information about the visitor's browser, operating system and device configuration.
For Apple devices, the attackers used the DarkSword exploit kit to target vulnerable iOS versions. Depending on the device, the malware could steal Safari cookies or extract more extensive information, including text messages, WhatsApp and Telegram databases, contacts, call history, photographs, Wi-Fi passwords and iCloud Keychain data.
Android users were targeted through a separate malware payload called AndroSnitch. The attack exploited vulnerabilities in Google Chrome to gain access to the device and collect browser information, including cookies, saved login details and Wi-Fi passwords.
Researchers identified several security vulnerabilities used in the campaign, including CVE-2025-43529, CVE-2026-20700 and CVE-2026-3910. These vulnerabilities allowed attackers to execute malicious code and bypass security protections on vulnerable devices.
Targeted espionage warning
Sekoia said the campaign appeared to focus on websites likely to attract strategically important visitors, particularly those connected to military organisations and defence-related industries.
