The Russia-linked menace actor generally known as APT29 is claimed to be behind a large-scale watering gap marketing campaign concentrating on iOS and Android customers by way of compromised web sites, faux domains, and a provide chain assault involving a Ukrainian net analytics service known as Plerdy website positioning Tracker.
“The injected JavaScript code collects browser and machine attributes,” Sekoia researchers Amaury-Jacques Garçon and Félix Aime mentioned in a technical report shared with The Hacker Information. “Then, the supply infrastructure delivers a platform-specific N-day exploit chain concentrating on both iOS or Android.”
The top aim of the assaults is to serve payloads able to stealing browser cookies, and in some circumstances, Wi-Fi passwords or full cellular machine information. The exercise, codenamed Poisoned Supply, was found by the French cybersecurity firm in mid-October 2026.
A defining side of the marketing campaign is using three an infection vectors –
- Compromise of authentic web sites to inject malicious JavaScript
- Lookalike websites masquerading as high-profile web sites within the U.S. (“america250[.]vacation”), Ukraine, Czech Republic, and Bulgaria
- Provide chain compromise of Plerdy website positioning Tracker between August 27 and September 3, 2026, by injecting malicious code into “a.plerdy[.]com/public/js/click on/important.js”
A number of the compromised web sites embody a significant trade commerce affiliation representing U.S. firms working within the chemical trade, a far-right European political occasion, and a Bulgarian military-related web site. It is suspected that the watering gap marketing campaign might have been designed to focus on particular people quite than a broad effort.
“It stays unclear whether or not the attackers meant to focus on guests to particular web sites or sought to compromise as many unpatched cellular units as doable, indiscriminately exfiltrating information earlier than selectively figuring out and exploiting info of curiosity,” Sekoia mentioned.
“Nonetheless, a number of of those websites are more likely to appeal to high-value or strategically necessary guests within the context of the Russia-Ukraine warfare. This provide chain assault unfold by way of high-value targets, akin to military, particular forces, and army gear (ballistic, UAV) web sites.”
Whatever the technique employed, all roads result in the identical payload: a JavaScript loader that profiles the customer’s machine and net browser, after which serves applicable next-stage malware. For iOS customers, it results in an exploit equipment known as DarkSword to reap cookies and full machine information.
On Android, the malware is provided to exfiltrate Chrome information and Wi-Fi passwords with out establishing persistence. A minimum of three totally different exploits have been recognized –
- Class A, which targets iOS units working iOS 16.7 and exploits CVE-2025-43529 (the identical vulnerability exploited by DarkSword) and CVE-2024-27834 to ship JavaScript malware for cookie theft.
- Class B, which targets iOS units working iOS 18.5 and exploits the DarkSword exploit chain comprising CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 to ship JavaScript malware for full machine information exfiltration. This contains SMS messages and iMessages; Apple Mail Envelope Index and Protected Index SQLite databases; voicemail; WhatsApp and Telegram databases; iCloud Keychain, Wi-Fi passwords; contacts; name historical past; Safari browser historical past and cookies; pictures; and information from Apple Well being, Calendar, Notes, and iCloud Drive.
- Class C, which targets Android units working Chrome variations from 139 by way of 145 (however explicitly excluding model 143 for causes that stay presently unknown) and exploits CVE-2026-3910 and CVE-2025-27038 to realize distant code execution, sandbox escape, privilege escalation, and in the end ship AndroSnitch to gather Chrome information and Wi-Fi passwords.
In all three circumstances, the exfiltrated information is distributed to the “advert.starx-net[.]com:8881/telemetry/v12” endpoint. The Android assault chain incorporates a examine to find out whether or not the focused machine is a Samsung Galaxy S25 Extremely by inspecting its mannequin identifier (i.e., SM-S938B). If the machine matches, the exploitation exercise is terminated.
AndroSnitch derives its identify from its similarities to ANDROSNATCH, a Chrome cookie-stealing payload that Google documented in August 2024 in reference to a suspected APT29 watering gap marketing campaign, which focused Android customers visiting a Mongolian authorities web site by leveraging a Chrome exploit chain involving CVE-2024-5274 and CVE-2024-4671.
“This operation additionally confirms the continued reuse of CSV [Commercial Surveillance Vendors] cellular exploit frameworks, akin to DarkSword, by state-sponsored intrusion units,” Sekoia mentioned. “The adoption of packaged N-day exploit chains lowers the associated fee and technical threshold required to conduct superior cellular exploitation.”
Coruna and DarkSword Kits Evolve
The event comes weeks after iVerify and Report URI detailed the P7 variant of DarkSword being delivered through half-click assaults that leverage ad-based infrastructure. In a single case, the exploit is claimed to have been propagated by way of a malicious Instagram advert themed across the World Cup and served from “ad-track[.]reside.”
The opposite pathway is a part of a legal marketing campaign dubbed DeadTag, wherein attackers purchase expired domains behind previous analytics and promoting tags which might be nonetheless loaded by hundreds of internet sites. The thought is to serve malicious JavaScript to iPhone guests and silently do the attacker’s bidding.
“It checks who’s visiting,” Report URI mentioned. “Search engines like google and yahoo, safety scanners, automated browsers and anything that appears like a bot will get nothing.”
The script then interacts with the attacker’s server, which then decides the vacation spot to which every customer must be redirected. The iPhone exploit paths that make the most of DeadTag result in the Coruna exploit equipment for older iPhones working iOS model 13 to 17.2.1 and DarkSword P7 for iOS units working 18.4 to 18.7.
“These should not phishing pages or faux app downloads, each kits assault the browser itself,” Report URI’s Scott Helme mentioned. “Merely opening the web page is sufficient to your machine to be compromised. There’s nothing to faucet, you needn’t click on any hyperlink, nothing to put in and no warning. If the iPhone is working a susceptible model of iOS, the equipment breaks out of the browser and installs spyware and adware on the machine.”
Different schemes result in decoy Google redirects, betting and on line casino rip-off sign-up pages, search commercials for automotive offers and dentists, and faux surveys and “you have gained” prize pages. Greater than 660 expired and re-registered domains are a part of the DeadTag community.
In accordance with an evaluation revealed by Zimperium zLabs, campaigns distributing Coruna and DarkSword exploit kits have continued to evolve, with 608 domains delivering Coruna-family code as of October 2026.
Though Coruna was initially developed by a nation-state actor for extremely focused operations, its subsequent leak following preliminary disclosure has made the toolkit extensively accessible to a number of menace actors for their very own campaigns.
In lots of circumstances, the lure websites have been discovered to explicitly instruct guests to exit their in-app browser or different iOS browser and open the hyperlink in Safari in order to set off the exploit chain relying upon the machine working system.
“Targets working iOS 17.2.1 or earlier obtain the legacy Coruna framework (exhibiting byte-identical JavaScript payloads throughout a number of recovered configurations),” safety researcher Santiago Rodriguez mentioned. “Conversely, units working later iOS builds obtain a DarkSword-derived execution chain.”
“The analyzed distribution footprint spans courting portals, AI-companion platforms, cryptocurrency promotions, media streaming providers, and – in a number of situations – compromised authentic websites serving the equipment through hidden iframes.”
