A hijacked analytics script pushed iOS and Android exploits
Sekoia traces a watering-hole campaign, linked to the Russian group APT29 with moderate to high confidence, that hijacked a popular analytics script to serve two-year-old Safari and Chrome exploits to visitors.
Sekoia says a campaign it calls Poisoned Source used a hijacked analytics script to serve browser exploits to iPhone and Android visitors, and attributes the activity to APT29, the Russian group also known as Cozy Bear or Midnight Blizzard, with moderate to high confidence.
Between 27 August and 3 September, the attackers compromised Plerdy, a Ukrainian web analytics tracker, and planted malicious code in its script, exposing thousands of mostly Ukrainian sites for a week. Visiting iPhones on iOS 16.7 got a chain built from CVE-2025-43529 and CVE-2024-27834 that stole cookies, while iOS 18.5 devices got a fuller chain pulling messages, email, WhatsApp and Telegram data, iCloud Keychain and photos. Android visitors on Chrome 139 to 145 got a separate chain, CVE-2026-3910 and CVE-2025-27038, that grabbed Chrome data and Wi-Fi passwords. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalogue on 4 November. Every bug used had already been patched; Sekoia found none of the chains worked against a fully updated device.
Why it matters: this is a supply-chain attack through exactly the kind of third-party script most sites embed without a second thought. If you load analytics, chat widgets or ad code from someone else’s server, their compromise becomes your visitors’ problem. The other defence is unglamorous but total here: none of this worked on a device that had actually installed its updates.