{
  "id": 18136188,
  "title": "APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits",
  "url": "https://urgent.news/2026/11/04/apt29-linked-hackers-hijack-web-analytics-script-to-deliver-ios-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-04T14:27:52.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html"
  },
  "original_language": "en",
  "account": "A Russia-linked hacking group called APT29 is responsible for a widespread watering hole campaign targeting users of iOS and Android devices. Compromised websites, fake domains, and a Ukrainian web analytics service called Plerdy SEO Tracker were used to inject malicious JavaScript code that collects browser and device attributes. This code then delivers a specific exploit chain tailored to either iOS or Android devices. The ultimate goal of the attacks is to steal browser cookies and, in some cases, Wi-Fi passwords or full mobile device data. The campaign, known as Poisoned Source, was discovered by French cybersecurity firm Sekoia in mid-October 2026. The compromised websites included major industry trade associations, a far-right European political party, and Bulgarian military-related websites. The attackers may have targeted specific individuals rather than a broad audience, but it's unclear whether they sought to compromise as many unpatched mobile devices as possible. The supply chain attack spread through high-value targets, such as army, special forces, and military equipment websites. Three different exploits have been identified, with each delivering data to the ad.starx-net[.]com:8881/telemetry/v12 endpoint. One exploit checks if the targeted device is a Samsung Galaxy S25 Ultra and terminates exploitation if it matches. The adoption of packaged N-day exploit chains, like DarkSword, lowers the cost and technical threshold required for advanced mobile exploitation. The P7 variant of DarkSword was delivered via half-click attacks using ad-based infrastructure and through criminal campaigns like DeadTag, which acquires expired domains behind old analytics and advertising tags.",
  "summary": "The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. \"The injected JavaScript code collects browser and device attributes,\" Sekoia researchers Amaury-Jacques Garçon and",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}