APT29’s “Poisoned Source” Hit Thousands of Sites — Zero-Click iOS Exploits Now on CISA’s KEV, Deadline November 18

Russia’s SVR-linked APT29 group compromised a widely used Ukrainian web analytics tool — Plerdy — to silently push zero-click exploit chains to iPhones and Android phones visiting thousands of legitimate websites. CISA has added the core Apple vulnerability to its Known Exploited Vulnerabilities catalog with a November 18 federal deadline. Any enterprise whose staff browses the web on managed iOS or Android devices is in scope.

DataWater Threat Intelligence Desk | Published November 6, 2026 | 9-minute read

Executive Summary

APT29 built a mobile collection platform out of the web’s analytics infrastructure — and ran it for months before anyone noticed.

Sekoia’s threat-detection team published its analysis of the “Poisoned Source” campaign on November 4, 2026, disclosing a large-scale operation that used legitimate websites as delivery points. Some sites were directly compromised; others became unwitting delivery vehicles because they loaded Plerdy, a Ukrainian SEO and behavioral analytics tracker, which APT29 appears to have backdoored for nine days this past August and September.

The injected script — Sekoia calls it “UltimateFingerprinter” — collects 394 device-environment data fields before deciding whether to serve exploit code. If the device appears to be a real mobile browser (not a crawler or sandbox), the server delivers one of three exploit chains. The chains use vulnerabilities Apple and Google patched months or years ago. That means a fully updated device is safe. But in enterprise environments with delayed MDM patch cycles or unmanaged personal devices, the attack window can remain open for a long time after a patch is released.

CISA added CVE-2024-27834 — the Apple Pointer Authentication bypass that anchors the iOS exploit chains — to its Known Exploited Vulnerabilities catalog on November 4, the same day Sekoia published the report. Federal agencies have until November 18 to remediate. The campaign’s scope, the caliber of the threat actor, and the breadth of data the most advanced chain (Class B, “DarkSword”) collects make this a priority for enterprise security teams regardless of whether they serve the federal government.

Why This Matters to CISOs and Security Leaders

Your staff’s phones are the target — and your MDM posture may be the gap. APT29 is a highly capable intelligence-collection actor linked to the 2016 DNC breach, the SolarWinds supply-chain attack, and multiple European election-interference operations. This campaign does not aim to encrypt files for ransom or steal credit card numbers. It aims to read encrypted messages, harvest credentials stored in Keychain, and collect the network configurations of the devices of people who work for organizations that interest Russian intelligence.

The supply chain vector is the more troubling finding. Plerdy is primarily used by Ukrainian organizations, but its install base extends beyond Ukraine. Any enterprise whose marketing, compliance, or IT team operates a website that loads the Plerdy tracker — or whose staff visits websites that do — may have been exposed during the nine-day window. Sekoia named victims that include a U.S. chemical-industry trade association and other Western organizations, in addition to Ukrainian and Eastern European sites.

The Timeline

APT29 did not need to compromise your employees directly. It compromised the analytics tool that visits your website — and your employees’ visits did the work for them.

Attack Chain Analysis

Delivery infrastructure

The campaign uses three parallel delivery mechanisms. First, APT29 injected malicious JavaScript directly into compromised legitimate websites, including a Ukrainian gas production company, a U.S. chemical-industry trade association, a Bulgarian military-related site, and others. Second, it registered adversary-in-the-middle (AiTM) lookalike domains that proxied legitimate high-traffic sites and injected the exploit script transparently into the proxied pages. Third — and most scalable — it modified the Plerdy analytics script on Plerdy’s own delivery infrastructure so that any website loading it would serve the exploit to its mobile visitors automatically.

Fingerprinting gate

Before serving an exploit, the “UltimateFingerprinter” script collects 394 JSON fields from 61 device-environment collectors. The delivery server withholds the exploit if the device has an implausible screen resolution or if maxTouchPoints is 0 (indicating a desktop or sandbox). This gate is designed to conserve exploits for real mobile devices and to defeat automated analysis.

Exploit chains

None of the chains establish persistence. After a device reboot, the malware is gone. The goal is a single collection session of high-value credential and communications data.

Threat Intelligence Breakdown

Attribution: Sekoia assesses with moderate to high confidence that APT29 conducted this campaign, based on overlap with a 2024 APT29 watering hole operation against Mongolian government sites that Google TAG attributed to the same exploit chains; victimology consistent with Russian intelligence interests (Ukraine, European political parties, defense-adjacent organizations); infrastructure spread across multiple hosting providers in a pattern consistent with past APT29 operations; and artifact overlaps on a compromised Czech site that matched a 2025 APT29 watering hole, confirmed by CERT partner information. Sekoia notes that AndroSnitch’s similarities to a 2024 Google TAG Android sample may indicate code lineage but are not by themselves conclusive. No other government or vendor has publicly confirmed the attribution as of November 6, 2026 (single-source: Sekoia).

What is unknown: The number of devices successfully exploited has not been disclosed. Victim organizations have not been publicly named beyond the websites Sekoia identified. The full scope of the Plerdy backdoor’s reach — specifically which of the thousands of Plerdy-loading sites were geographically targeted versus which received the exploit indiscriminately — has not been released. Sekoia is withholding additional IoCs and YARA rules, distributing them directly to national CERTs and law enforcement.

Indicators of compromise (defanged; source: Sekoia “Poisoned Source” report, November 4, 2026):

Enterprise Impact

Credential exposure: Class B (DarkSword) extracts Keychain items. That means every password, certificate, and authentication token stored on a compromised iPhone — including VPN credentials, SSO tokens, corporate app passwords, and two-factor backup codes — is in APT29’s possession if the device was running an unpatched iOS 18.5 build during the exposure window.

Communications exposure: The chain reads iMessage, WhatsApp, Telegram, and SMS content. For executives, board members, legal counsel, or anyone who discusses sensitive business matters on a personal iPhone, that conversation history is an intelligence windfall for a nation-state.

Network exposure: Both the iOS and Android chains collect Wi-Fi network names and passwords. An attacker with those credentials can reach internal networks the device connected to — including corporate offices and home offices that VPN into the enterprise environment.

Who is at elevated risk: Organizations with Ukrainian partnerships or supply-chain connections; defense contractors; European political and policy organizations; companies in sectors that interest Russian intelligence (energy, chemicals, finance, technology). The U.S. trade association named among compromised sites suggests that interest is not limited to government targets. Any enterprise whose employees visited a Plerdy-using site between August 26 and September 3 on an unpatched device may have had credentials collected.

Breach-notification implications: If a compromised device belonged to an employee and contained personal data about customers, patients, or other protected individuals, the enterprise may have a notification obligation under HIPAA, state privacy laws, or the EU GDPR depending on what the Keychain and iCloud Drive contents included.

What Security Leaders Should Do Next

Today

1. Verify iOS and Android patch levels across your MDM fleet. Every iOS device should be on 17.5 or later (iOS 17 branch) or a fully patched iOS 18.5 build. Every Android device should be on Chrome 146+ and a patched OS build. Pull an MDM compliance report and treat non-compliant devices as potentially compromised if the user visited any website between August 26 and September 3, 2026.
2. Block the listed IoC domains and IPs at your DNS resolver, proxy, and firewall. The delivery and exfiltration infrastructure is documented in the Threat Intelligence section above. Block it now.
3. Audit third-party scripts on every website your organization operates. Search your website’s JavaScript inventory for the Plerdy script. If it is present, review the JavaScript for injected code, then check web server logs from August 26–September 3 for unexpected outbound connections or abnormal script-loading behavior.
4. Alert on the replay-guard cookie. If your mobile management solution or endpoint telemetry can inspect cookies, alert on any device that has set a cookie named VDGH_TOKEN_REF. Its presence means the device was targeted.

Within 48 hours

1. For high-risk devices — executives, legal, BD, government-relations staff — consider whether a full wipe is warranted if the device was unpatched during the August–September window and there is no way to confirm it was not targeted. Stolen Keychain credentials do not disappear when you apply a patch.
2. Rotate credentials for any account whose password was stored on an iPhone running a vulnerable iOS version. Prioritize VPN credentials, SSO provider passwords, and cloud-infrastructure access tokens.
3. Brief your website and marketing team on third-party script hygiene. Every analytics, chat, A/B testing, and customer-data script on your website is a potential Plerdy-style vector. Establish a formal approval process for adding or retaining third-party scripts, and require vendors to disclose their own security practices and incident response commitments.
4. Review outbound DNS and proxy logs for any resolution of the listed exfiltration domains from your corporate network or MDM-managed devices, going back to August 2026.

Long-term

1. Enforce rapid MDM patching for mobile devices. The entire Poisoned Source campaign depended on devices that were behind on OS updates. A policy that requires iOS or Android patches within 14 days of release, with a hardware block for non-compliant devices, would have made this campaign fail against your users.
2. Treat third-party analytics scripts as a supply-chain risk category. Request security attestations from all analytics and tag-management vendors. See DataWater’s briefing on CI/CD supply-chain risks for a parallel framework applied to development pipelines.
3. Classify mobile devices by user role for nation-state threat modeling. Not every employee is a target for Russian intelligence. But executives, government-relations staff, legal counsel, M&A teams, and anyone with network access credentials stored on their device are. Apply enhanced MDM controls — stricter patching, app allowlisting, certificate pinning verification — to that tier.
4. Nation-state threat modeling for mobile is now a board topic. APT29’s tactics this year — SolarWinds-era supply-chain patterns documented in peer nation-state campaigns, and now Poisoned Source — make mobile endpoint hygiene a question your board should be able to answer about. Add it to your next board security briefing.

Winners and Losers

Final Executive Takeaway

APT29 built its collection operation out of your employees’ browsing habits.

Plerdy is a legitimate tool used by thousands of organizations that had no idea they were delivering Russian malware to their visitors’ phones for nine days this summer. The only technical requirement on the visitor’s side was an unpatched iPhone or Android device. No click, no download prompt, no warning.

The patch for CVE-2024-27834 has existed since May 2024. The five-CVE DarkSword chain against iOS 18.5 was patchable by any organization running a current update cycle. This campaign worked because mobile patch compliance is treated as an individual’s responsibility rather than a managed security control.

Update your devices. Rotate credentials that may have been on unpatched iPhones in August and September. Audit your website’s third-party scripts. And build the MDM enforcement policy that makes the next Poisoned Source campaign fail before it starts.

Frequently Asked Questions

Sources

Primary sources: Sekoia TDR, “Poisoned Source: APT29 Watering Holes Targets Mobile Devices,” November 4, 2026; CISA Known Exploited Vulnerabilities catalog, CVE-2024-27834 entry, November 4, 2026 (direct fetch not available; confirmed via CISA alert index and multiple secondary sources). Secondary reporting reviewed and confirmed against primary source: The Hacker News, “Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says,” November 2026; CybelAngel, “APT29-Linked Hackers Hijacked an Analytics Script to Hit Phones,” November 2026; Red Eye Security, “APT29-Linked Poisoned Source Campaign,” November 2026. IoCs taken verbatim from the Sekoia report. Attribution assessed by Sekoia; no second government confirmation as of publication date. Reflects public reporting as of November 6, 2026.