Russian Hackers Hit iOS and Android Phones in Zero-Click Watering Hole Attack

Russian state-sponsored operators widely tracked as APT29 have executed an expansive watering hole campaign engineered to silently hijack iPhones and Android devices across North America and Europe, cybersecurity researchers revealed on November 4, 2026. The operation, codenamed "Poisoned Source" by French threat intelligence firm Sekoia, compromised high-profile government, defense, energy, and commercial websites to deliver automated exploit chains straight into mobile browsers without requiring victims to click malicious links, download rogue applications, or accept user prompts.

By poisoning trusted online portals, cloning sensitive diplomatic web properties, and executing a week-long supply chain breach of a major Ukrainian analytics platform, the Kremlin’s Foreign Intelligence Service (SVR) weaponized commercial-grade exploit kits to vacuum up browser cookies, Wi-Fi profiles, secure messaging databases, and device keychains. The attack operates as a zero-click mobile attack from the user's perspective: landing on an infected webpage automatically initiates deep device fingerprinting, selects a custom-tailored operating system exploit chain, and exfiltrates personal data while bypassing platform sandboxes.

Technical telemetry published by Sekoia’s Threat Detection & Research (TDR) team indicates the campaign selectively victimized devices running specific, unpatched iterations of Apple iOS and Google Android. Rather than burning rare zero-day exploits, Moscow repurposed weaponized "n-day" chains—flaws previously disclosed and patched by software vendors—that had been packaged by commercial surveillance developers. The incident highlights an alarming tactical shift: top-tier state intelligence services are bypassing fortified desktop workstations to target the personal and corporate mobile devices of high-value personnel through the digital infrastructure they interact with daily.

+----------------------------------------------------------------------------------------------------+
|                                    OPERATION POISONED SOURCE                                       |
+----------------------------------------------------------------------------------------------------+
                                                  |
       +------------------------------------------+------------------------------------------+
       |                                          |                                          |
       v                                          v                                          v
 [Vector 1: Direct Injections]       [Vector 2: Reverse Proxies]       [Vector 3: Supply Chain Breach]
  • Ukrainian gas producer            • america250[.]holiday            • Plerdy SEO Tracker hijacked
  • U.S. chemical trade body          • Raffles London clone            • a.plerdy[.]com tracker code
  • Bulgarian military portal           (Diplomatic hotel venue)        • Hundreds of UA defense sites
       |                                          |                                          |
       +------------------------------------------+------------------------------------------+
                                                  |
                                                  v
                                     [Reconnaissance Module]
                              394-field profiler via 61 collectors
                               Screen dimensions, touch points, OS
                                                  |
                                                  v
                                      [Platform Exploit Chains]
                                                  |
             +------------------------------------+-----------------------------------+
             |                                                                        |
             v                                                                        v
   [Apple iOS Pathways]                                                     [Google Android Pathway]
  • Class A (iOS 16.7):                                                    • Class C (Chrome 139-145):
    CVE-2025-43529 + CVE-2024-27834 (PAC Bypass)                             CVE-2026-3910 + CVE-2025-27038
    Result: Safari cookie exfiltration                                        (Renderer RCE + Adreno LPE)
  • Class B (iOS 18.5 - DarkSword Kit):                                     Excludes: SM-S938B (S25 Ultra)
    Full 5-flaw chain across WebKit & XNU                                   Payload: "AndroSnitch" stealer
    Result: Messages, Keychain, Health, Photos                                Result: Chrome data, Wi-Fi keys
             |                                                                        |
             +------------------------------------+-----------------------------------+
                                                  |
                                                  v
                                      [Telemetry Exfiltration]
                               ad.starx-net[.]com:8881/telemetry/v12
                               Volatile, in-memory execution only

The Vectors of Poisoned Source: Web Injections, Clones, and Supply Chains

Watering hole operations—formally known as strategic web compromises—rely on identifying digital gathering places frequented by target groups and subverting those platforms to deliver hostile payloads. In Operation Poisoned Source, APT29 orchestrated three distinct infection vectors operating in concert, casting a dragnet over strategically significant targets across the transatlantic alliance.

+----------------------------------------------------------------------------------------------------+
|                               VECTOR 1: STRATEGIC WEB INJECTIONS                                   |
+----------------------------------------------------------------------------------------------------+
   Attacker compromises CMS/Web Server
   └── Injects obfuscated JavaScript snippet
       ├── Ukrainian Energy Infrastructure (State gas producer)
       ├── American Industrial Base (U.S. chemical sector trade association)
       ├── European Political Infrastructure (Czech far-right parliamentary party)
       └── Eastern European Defense (Bulgarian military-affiliated portal)

+----------------------------------------------------------------------------------------------------+
|                               VECTOR 2: ADVERSARY-IN-THE-MIDDLE REVERSE PROXIES                    |
+----------------------------------------------------------------------------------------------------+
   Target lured via Spear-Phishing / Targeted Redirection
   └── Requests forwarded through attacker-controlled proxy
       ├── america250[.]holiday ---> Proxies legitimate America250.org celebration portal
       └── Raffles London Clone ---> Proxies luxury Whitehall hotel site (OWO venue)
           └── Real-time code injection executes mobile reconnaissance in transit

+----------------------------------------------------------------------------------------------------+
|                               VECTOR 3: THIRD-PARTY ANALYTICS SUPPLY CHAIN                         |
+----------------------------------------------------------------------------------------------------+
   Attacker breaches Central CDN: a.plerdy[.]com (Aug 27 - Sep 3, 2026)
   └── Malicious payload appended to main.js tracking script
       └── Propagated to hundreds of client websites loading the remote resource:
           ├── Tactical UAV & Drone System Manufacturers
           ├── Ballistic Technology Contractors
           ├── Special Operations and Military Command Portals
           └── Ukrainian Commercial Portals

Vector 1: Direct Injections into Legitimate Portals

The primary infection path involved breaking into authentic web infrastructure and injecting malicious JavaScript snippets into active templates. Sekoia's incident response teams traced the malicious code across an array of seemingly disparate entities:

An unnamed Ukrainian natural gas production company providing municipal energy supply.
A prominent chemical industry trade association based in Washington, D.C., representing major U.S. manufacturing conglomerates.
A far-right European political party active in the Czech Republic.
A specialized website associated with Bulgarian defense contractors and military procurement.
Secondary, lower-profile entities, including an Australian healthcare clinic.

The selection of compromised hosts reflects Russian foreign intelligence requirements. Compromising a critical Ukrainian energy portal yielded visibility into infrastructure leadership during winter wartime operations, while planting traps within American chemical trade associations offered access to domestic supply-chain logistics and proprietary materials intelligence.

Vector 2: Reverse-Proxy Clones

To complement direct injections, APT29 established an Adversary-in-the-Middle (AiTM) reverse-proxy apparatus. Operators registered lookalike domains, including america250[.]holiday, designed to visually replicate legitimate properties—in this case, America250, the non-partisan commission planning the 250th anniversary of the signing of the Declaration of Independence.

The rogue server pulled live content dynamically from the legitimate site, passing traffic between the user and the genuine portal while splicing exploit code into the document object model (DOM). Researchers believe this domain served as a landing page for spear-phishing messages targeting American political figures, civic leaders, and event organizers.

A second clone mimicked the online reservation portal of Raffles London at The OWO. Situated in the Old War Office building in Whitehall, opposite the UK Ministry of Defence, the luxury hotel routinely accommodates high-ranking foreign dignitaries, military delegates, and intelligence chiefs. Open-source records demonstrate that Ukrainian President Volodymyr Zelensky stayed at the facility during his diplomatic summit in London on October 14, 2026. Although analysts found no direct evidence that President Zelensky's devices were infected, poisoning the digital front door of the hotel offered the SVR an avenue to track diplomatic staff, security details, and international envoys moving through the British capital.

Vector 3: The Plerdy Analytics Supply Chain Poisoning

The campaign's most aggressive distribution vector was a software supply chain compromise. Between August 27 and September 3, 2026, APT29 infiltrated the infrastructure of Plerdy SEO Tracker, a popular web analytics and conversion-rate optimization service based in Ukraine.

By compromising the central content delivery network (CDN) server hosting Plerdy's client tracking scripts, the attackers modified a.plerdy[.]com/public/js/click/main.js. The poisoned script, normally embedded across thousands of websites to track mouse clicks and user scroll depth, delivered hostile reconnaissance code to every visiting mobile browser.

During the seven days the modification persisted, hundreds of Ukrainian portals loading the Plerdy tracker exposed their audiences to the exploit apparatus. Compromised downstream sites included:

Official platforms tied to the Ukrainian Armed Forces and specialized units.
Domestic manufacturers producing unmanned aerial vehicles (UAVs) and tactical electronic warfare components.
Developers of specialized ballistic technology and armaments.
Civil society groups organizing volunteer logistics for frontline units.

By targeting a single analytics vendor, Moscow transformed a mundane digital tracking library into an automated collection net spanning the Ukrainian military-industrial base.

Initial Reconnaissance: Device Fingerprinting at the Edge

Once a mobile user navigates to an infected portal, the injected JavaScript initiates an automated, multi-tiered reconnaissance protocol. Mobile web browsers sandbox site operations by design, restricting web pages from accessing underlying system resources without authorization. To breach that perimeter, attackers must exploit distinct memory-corruption vulnerabilities unique to specific browser engines and operating system builds. Delivering the wrong exploit risks crashing the browser, triggering security logging, or alerting security operations centers (SOCs) to the presence of host infrastructure.

+----------------------------------------------------------------------------------------------------+
|                         JAVASCRIPT PROFILING & TELEMETRY TRANSACTION                               |
+----------------------------------------------------------------------------------------------------+
  Client Mobile Browser                                                Adversary Staging Server
           |                                                                     |
           | ----- 1. Loads Compromised HTML/Script ---------------------------> |
           |                                                                     |
           | <---- 2. Returns Obfuscated Fingerprinting Module ----------------- |
           |       (Executes 61 Collectors; Extracts 394 Unique Fields)          |
           |                                                                     |
           |       [Validation Checks Performed In-Browser]                      |
           |       • Navigator TouchPoint Count != 0                             |
           |       • Screen Width/Height Ratio conforms to mobile profile        |
           |       • WebGL Renderer Matches Mobile GPU Architecture              |
           |       • Canvas Hash Divergence Rules Out Headless Emulators         |
           |                                                                     |
           | ----- 3. Sends Encrypted JSON Fingerprint ------------------------> |
           |                                                                     |
           |       [Adversary Server Validates Hardware Profile]                 |
           |       • Compares OS and Browser Version against Exploit Matrix      |
           |       • Evaluates Samsung Model String (SM-S938B Abort Filter)      |
           |                                                                     |
           | <---- 4. Returns Matched Platform Exploit (Class A, B, or C) ------ |
           |                                                                     |
           v                                                                     v

Sekoia researchers Amaury-Jacques Garçon and Félix Aime discovered that the loader deploys an advanced fingerprinting engine concealed inside dead AngularJS library code blocks. The script queries 394 distinct hardware and software attributes using 61 individual data-gathering routines. The data collected includes:

Hardware and Display Parameters: Pixel ratio, true screen resolution, physical viewport boundaries, device color depth, hardware concurrency counts, and touch-point values.
Rendering Subsystems: WebGL driver characteristics, vendor extensions, canvas fingerprint rendering behaviors, and audio API latency values.
Browser Runtime Context: Installed system fonts, timezone offsets, language preferences, available browser extensions, performance metrics, and DOM engine capabilities.
Network Signatures: Client round-trip latencies, local WebRTC IP address exposures, and HTTP header properties.

The profiling routine functions as a defensive countermeasure against automated analysis. The server evaluates whether the visiting entity is a genuine mobile user or a headless crawler operating inside a threat-intelligence sandbox. If the client reports zero touch points, runs an unnatural screen ratio, or exhibits software canvas rendering linked to automation tools such as Selenium or Puppeteer, the server drops the connection without returning an exploit.

If the client matches genuine mobile hardware running a targeted software build, the server parses the profile and delivers an operating-system-specific payload.

Weaponizing N-Day Bugs on iOS and Android

The core mechanics of this zero-click mobile attack rely on chained vulnerabilities that breach browser isolation, escalate privileges, and execute arbitrary code in kernel space. The campaign leveraged three separate exploit classes targeting specific iterations of Apple Safari (WebKit) and Google Chrome (Blink/V8).

+----------------------------------------------------------------------------------------------------+
|                                      EXPLOIT CLASS ARCHITECTURE                                    |
+----------------------------------------------------------------------------------------------------+

  CLASS A: iOS 16.7 Targeted Safari Stealer
  --------------------------------------------------------------------------------------------------
  CVE-2025-43529 (WebKit Memory Corruption) ---> CVE-2024-27834 (PAC Bypass)
  └── Outcome: Arbitrary read/write in Safari context; intercepts active session cookies.

  CLASS B: iOS 18.5 DarkSword Commercial Surveillance Chain
  --------------------------------------------------------------------------------------------------
  CVE-2025-43529 (WebKit RCE)
      │
      ▼
  CVE-2026-20700 + CVE-2025-14174 (Sandbox Escape)
      │
      ▼
  CVE-2025-43510 + CVE-2025-43520 (Kernel Privilege Escalation via XNU)
      └── Outcome: Root execution; full access to Keychain, SMS, WhatsApp, and private media.

  CLASS C: Android Chrome and GPU Graphics Chain
  --------------------------------------------------------------------------------------------------
  CVE-2026-3910 (V8 Engine Memory Optimization Bug)
      │
      ▼
  CVE-2025-27038 (Qualcomm Adreno GPU Kernel Driver Flaw)
      └── Outcome: Escapes Chrome Site Isolation; deploys AndroSnitch stealer in memory.

Class A: Targeted WebKit and PAC Bypass on iOS 16.7

The first iOS attack chain targets Apple hardware running iOS 16.7, linking two distinct flaws to execute unauthorized code within the Safari browser sandbox:

CVE-2025-43529: A memory-safety defect in WebKit, the open-source rendering engine underpinning Safari and all browsers running on iOS. The vulnerability stems from improper bounds validation during dynamic JavaScript object optimization, allowing attackers to trigger a type confusion condition. By feeding the engine carefully shaped nested arrays, the script achieves stable out-of-bounds read and write capabilities inside Safari’s memory heap.
CVE-2024-27834: A security vulnerability impacting Apple’s Pointer Authentication Code (PAC) implementation. PAC is an architectural hardware defense introduced in Apple's A12 Bionic and newer chips that signs memory pointers using cryptographic primitives, preventing attackers who gain arbitrary memory access from hijacking control flow. CVE-2024-27834 bypasses this mitigation by manipulating pointer verification logic.

Once attackers establish read-and-write primitives and neutralize PAC protections, they deploy an in-memory JavaScript module tailored to extract active session tokens. The payload systematically queries Safari’s local cookie jar, exfiltrating authenticated session tokens for Google accounts, Microsoft 365, social networks, and enterprise identity providers. By acquiring valid cookies, the SVR can clone a user's authenticated web sessions from remote systems, bypassing multi-factor authentication (MFA) without cracking passwords or intercepting real-time tokens.

Following Sekoia’s technical disclosure, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on November 4, 2026, ordering civilian federal agencies to patch the vulnerability across all government-managed mobile fleets.

Class B: Full Device Compromise via DarkSword on iOS 18.5

For newer Apple hardware operating on iOS 18.5, APT29 deployed Class B: an advanced five-flaw exploit chain derived from the commercial surveillance kit known as "DarkSword". While Class A restricts its execution to the browser to harvest web cookies, Class B shatters all system isolation boundaries, escalating privileges from WebKit into the XNU operating system kernel.

+----------------------------------------------------------------------------------------------------+
|                             CLASS B: DARKSWORD EXPLOIT CASCADE (iOS 18.5)                          |
+----------------------------------------------------------------------------------------------------+
   [WebKit Sandbox Layer]
   1. CVE-2025-43529: Initial JavaScript memory corruption grants arbitrary memory read/write.
   
   [Sandbox Isolation Boundary]
   2. CVE-2026-20700 & CVE-2025-14174: Chained inter-process communication (IPC) flaws exploit
      unsanitized serialized parameters, enabling escape from the restricted Safari renderer.
   
   [XNU Kernel Layer]
   3. CVE-2025-43510 & CVE-2025-43520: Race conditions in XNU virtual memory management and I/O Kit
      subsystems allow kernel memory corruption, yielding unrestricted root-level access.
   
   [Local Database Access]
   4. Payloads extract SQLite databases across private app sandboxes without triggering alerts.

By seizing kernel-level control, the payload gains unrestricted access to the file system, programmatically bypassing Apple’s data protection APIs. The injected module searches local application sandboxes to extract high-value databases, including:

Communications and Messaging: SMS and iMessage local stores, Apple Mail Envelope Index and Protected Index SQLite files, voicemail files, and unencrypted local databases for WhatsApp and Telegram.
Credentials and Keychains: Cryptographic keys, enterprise single-sign-on (SSO) certificates, Wi-Fi passwords, and saved credentials held inside the iCloud Keychain.
Device Telemetry and Media: Detailed address books, cellular call histories, Safari browsing histories, location cache logs, and the device's local photo library.
Sensitive Cloud Stores: Local caches from Apple Health, Notes, Calendar, and synced iCloud Drive folders.

Class C: Android Execution and the AndroSnitch Payload

The campaign's Android pipeline, designated Class C, targets users visiting compromised sites via Google Chrome versions 139 through 145. Intriguingly, the delivery server’s JavaScript logic contains an explicit exemption rule skipping Chrome version 143—an anomaly analysts attribute to an internal software defect or an unhandled crash condition discovered by the exploit's original developers during internal testing.

The Class C chain leverages two vulnerabilities to execute code and breach host isolation:

CVE-2026-3910: A remote code execution flaw in Google Chrome’s V8 JavaScript engine. Flawed bounds analysis inside the engine’s just-in-time (JIT) compiler allows the script to read and write outside intended array memory allocations, hijacking renderer execution.
CVE-2025-27038: A local privilege escalation flaw located within Qualcomm’s Adreno GPU kernel graphics drivers. Attackers use the compromised Chrome renderer process to send malformed system calls directly to the GPU driver interface, escaping Chrome's multi-process sandbox and achieving local root execution.

Once elevated, the exploit drops a lightweight memory-resident extraction utility dubbed "AndroSnitch". AndroSnitch hunts for Chrome’s underlying configuration folders, copying user session cookies, autofill database tables, saved website logins, active browsing history, and saved Wi-Fi network configurations before exfiltrating the contents to adversary command infrastructure.

+----------------------------------------------------------------------------------------------------+
|                         ANDROSNITCH ANDROID MODEL-EXCLUSION KILL SWITCH                            |
+----------------------------------------------------------------------------------------------------+
   Attacker Profiler queries: navigator.userAgent & WebGL Parameter Strings
                      │
                      ▼
   Does Hardware String match: "SM-S938B" (Samsung Galaxy S25 Ultra)?
                      │
        +-------------+-------------+
        │                           │
       YES                          NO
        │                           │
        ▼                           ▼
   [TERMINATE TRANSACTION]     [DEPLOY EXPLOIT]
   • Drop network connection   • Execute CVE-2026-3910 (Chrome V8)
   • Wipe memory variables     • Escalate via CVE-2025-27038 (Adreno GPU)
   • Prevent device crash      • Inject AndroSnitch into process memory

The Android loader features a hardware-specific kill switch: it inspects device model strings, and if it detects the identifier SM-S938B—the European and international global build of the Samsung Galaxy S25 Ultra—exploitation immediately halts.

Researchers point to several operational explanations for this exclusion:

The Galaxy S25 Ultra includes vendor-specific Knox hardware isolation and kernel integrity protections that may cause the Adreno driver exploit to destabilize, generating an automated crash dump to Samsung’s diagnostic servers.
The exploit's developers may have maintained a dedicated, higher-tier zero-day chain for the flagship device, choosing not to risk detection by firing a brittle n-day exploit against an aggressive device monitoring stack.
SVR operators may have sought to avoid targeting specific VIP accounts or friendly government liaisons known to be issued that specific hardware.

Exfiltration Infrastructure and Ephemeral Tradecraft

A defining operational characteristic of Operation Poisoned Source is its complete absence of on-disk persistence. Traditional mobile spyware implants, such as NSO Group’s Pegasus or Intellexa’s Predator, install persistent system daemons, patch startup scripts, or modify base operating system files to retain control after a device restarts. In contrast, every exploit chain observed in the Poisoned Source campaign operates entirely in memory.

+----------------------------------------------------------------------------------------------------+
|                             EPHEMERAL MOBILE SPYWARE TRADECRAFT                                    |
+----------------------------------------------------------------------------------------------------+
   Traditional Persistent Spyware                       APT29 Ephemeral Model (Poisoned Source)
   ──────────────────────────────────                   ───────────────────────────────────────
   • Writes hooks to system partitions.                 • Executes strictly in volatile process memory.
   • Survives device power cycles.                      • Erased upon reboot or browser process crash.
   • Generates forensic trace files.                    • Leaves minimal post-compromise artifacts.
   • Vulnerable to jailbreak detection.                 • Evades standard Mobile EDR endpoint agents.
   • High risk of payload recovery by SOCs.             • Lowers exposure: payload pulled on-the-fly.
   • Primary Objective: Continuous real-time wiretap.   • Primary Objective: Rapid theft of cloud tokens.

The moment an exploit achieves execution, the payload reads targeted application databases, packages the information into encrypted JSON archives, and exfiltrates the telemetry using HTTPS POST requests sent to a shared command-and-control (C2) endpoint:

ad.starx-net[.]com:8881/telemetry/v12

Once the data is transmitted, the in-memory payload quietly terminates. A simple device reboot flushes the attacker's code from system RAM.

This volatile design gives the SVR significant operational advantages:

Evasion of Mobile Endpoint Detection: Mobile security software and Mobile Device Management (MDM) platforms perform file integrity and anomaly scans against persistent storage. An exploit residing solely in browser memory generates no file writes, evading traditional endpoint signatures.
Forensic Evasion: When compromised users realize their accounts are acting abnormally and submit their phones for analysis, investigators find clean file systems with no dormant malware to decompile or attribute.
Persistent Access Through Cloud Tokens: Because the payload steals authentication cookies and API refresh tokens, the SVR doesn't need to maintain a continuous implant on the physical phone. Using stolen tokens, Russian operators can maintain months of cloud access across Microsoft Exchange, Google Workspace, and cloud storage systems—access that persists long after the victim restarts their device.

The operators introduced a minor bug in their iOS deployment code. The payload was designed to set a client-side marker cookie upon successful infection, instructing the loader not to re-exploit the same device for 24 hours to prevent unstable crashes. Due to a formatting error in the JavaScript timestamp calculation, the cookie’s expiration was mistakenly set to 60 seconds rather than 86,400 seconds, causing devices to clear the marker almost immediately.

The Commercial Spyware Pipeline: Repurposing Commercial Kits

The technical similarities between the tools deployed in Operation Poisoned Source and commercial spyware frameworks demonstrate how tools built by private cyber-intelligence vendors are proliferating into state-sponsored arsenals.

+----------------------------------------------------------------------------------------------------+
|                               THE PROLIFERATION CYCLE OF COMMERCIAL EXPLOITS                       |
+----------------------------------------------------------------------------------------------------+
   1. Commercial Surveillance Vendors (CSVs)
      (Intellexa, NSO Group, PARS Defense)
      └── Develop proprietary zero-day chains to sell to sovereign intelligence clients.
                      │
                      ▼
   2. Discovery, Patching, and Exposure
      └── Security teams (Google TAG, Citizen Lab, Apple) detect exploits in the wild.
      └── Operating system vendors release updates (creating "N-Day" status).
                      │
                      ▼
   3. Secondary Market & Intelligence Acquisition
      └── State espionage services (SVR / APT29) acquire exploit material via brokers,
          offensive contractor leaks, or forensic recovery from compromised infrastructure.
                      │
                      ▼
   4. Operational Re-Weaponization
      └── Packaged into modular watering hole delivery frameworks (DarkSword, AndroSnitch).
      └── Deployed broadly against unpatched mobile targets across allied nations.

In August 2024, Google’s Threat Analysis Group (TAG) published an investigation authored by researcher Clement Lecigne detailing a watering hole campaign targeting Mongolian government domains, including cabinet.gov.mn and mfa.gov.mn. That campaign compromised official sites to drop iOS and Android exploits aimed at stealing browser cookies. Google determined that the exploits were identical in code structure, layout, and memory corruption triggers to mobile chains previously developed by commercial spyware vendors Intellexa and NSO Group.

Google’s 2024 findings uncovered a direct link to the 2026 Poisoned Source campaign:

The ANDROSNATCH Heritage: The 2024 Mongolian watering hole delivered an Android Chrome stealer module tracked by Google as ANDROSNATCH. The Class C payload recovered by Sekoia in 2026 shares structural, functional, and cryptographic traits with ANDROSNATCH, prompting researchers to christen the new strain AndroSnitch.
The DarkSword Ecosystem: The Class B exploit kit, DarkSword, first surfaced in commercial surveillance circles. Google researchers tracked DarkSword through early 2026 as an iOS exploitation package used by customers of PARS Defense, an offensive surveillance vendor based in Turkey, as well as multiple state-aligned espionage clusters. A full version of DarkSword was uploaded to VirusTotal in September 2026, confirming its spread beyond its original developers.

The evolution of these campaigns shows how state-backed operators acquire and redeploy commercial exploits:

Operational Parameter	2024 Mongolian Government Campaign (Google TAG)	2026 Operation Poisoned Source (Sekoia TDR)
Attributed Actor	APT29 (Midnight Blizzard / SVR)	APT29 (Midnight Blizzard / SVR)
Infection Delivery	Hidden iframes on two government portals	Web injections, reverse-proxies, analytics supply chain
Mobile Scope	iOS 16.6.1 and Android Chrome m121–m123	iOS 16.7, iOS 18.5, and Android Chrome 139–145
Commercial Exploits	Intellexa (CVE-2023-41993), NSO Group (CVE-2024-5274)	DarkSword commercial framework, Adreno GPU driver chain
Extraction Scope	Targeted list of webmail and SSO cookies	Full cookie extraction, Wi-Fi profiles, device keychain, SQLite DBs
Android Payload	ANDROSNATCH cookie collector	AndroSnitch (expanded credential and network harvester)

Reusing n-day exploit kits fundamentally lowers the cost and barrier to entry for carrying out a zero-click mobile attack. Developing sovereign zero-day exploit chains against modern smartphone operating systems requires millions of dollars in research and development, and exposing those capabilities risks burns when security vendors patch the flaws. By purchasing or salvaging n-day frameworks sold by commercial vendors, state actors like the SVR can launch high-volume operations against unpatched mobile targets while keeping their zero-day reserves hidden for high-priority targets.

Intelligence Objectives and the SVR Strategic Playbook

The diverse victim footprint of Operation Poisoned Source mirrors the broad collection priorities of the SVR during wartime. While military intelligence agencies like the GRU (such as Sandworm or Fancy Bear) often focus on disruption, wiper attacks, and frontline tactical systems, the SVR prioritizes long-term espionage, political intelligence, and strategic monitoring.

+----------------------------------------------------------------------------------------------------+
|                         APT29 TARGETING PROFILE IN OPERATION POISONED SOURCE                       |
+----------------------------------------------------------------------------------------------------+

  1. UKRAINIAN FRONT & DEFENSE SUPPLY CHAIN
     • Plerdy Analytics Infiltration: Harvests data from drone operators, missile engineers,
       and tactical command staff visiting military and defense equipment sites.
     • Gas Production Infrastructure: Monitored domestic energy generation and resource routing.

  2. WESTERN MILITARY AID & DIPLOMACY
     • Bulgarian Military Hub: Targeted eastern European weapons distribution and ammunition contracts.
     • Raffles London Hotel: Targeted diplomatic delegations and national security entourages
       frequenting top London defense and diplomatic venues.

  3. U.S. STRATEGIC COMMERCE & INFRASTRUCTURE
     • Chemical Trade Association: Extracted data from senior industrial figures tied to critical
       supply chains, defense manufacturing, and regulatory policies.
     • America250 Imitation Domain: Targeted civic leaders, political figures, and donors.

  4. EUROPEAN DOMESTIC POLITICS
     • Czech Far-Right Political Organization: Gathered intelligence on fringe political movements,
       aligning with past APT29 campaigns targeting European political parties.

The scale of the campaign creates an operational tension between targeted surveillance and bulk data collection. By hacking Plerdy, APT29 effectively set a trap across hundreds of unrelated civilian and commercial websites.

Analysts suggest this approach serves a two-phase intelligence model:

Phase One (Broad Collection): The automated watering hole harvests thousands of cookie packages, credential databases, and device fingerprints from mobile users, transmitting the caches to Russian intelligence data lakes.
Phase Two (Selective Exploitation): Analysts in Moscow filter the stolen data using automated search queries, flagging corporate email sessions, government identity tokens, or communications tied to military figures.

Once verified, high-value accounts can be compromised remotely from cloud interfaces, leaving no active malware on the victim's physical smartphone to reveal the breach.

Enterprise Defense and Mitigating Zero-Click Mobile Attacks

Operation Poisoned Source demonstrates that modern mobile devices cannot rely on built-in application sandboxes alone to defend against web-based zero-click threats. Because the campaign compromises devices through browser interactions without requiring users to download apps, traditional endpoint protection strategies require re-evaluation.

+----------------------------------------------------------------------------------------------------+
|                               MOBILE THREAT MITIGATION ARCHITECTURE                                |
+----------------------------------------------------------------------------------------------------+
                                                  │
                 ┌────────────────────────────────┴────────────────────────────────┐
                 ▼                                                                 ▼
      [Device-Level Hardening]                                           [Enterprise Identity Controls]
  • Operating System Patch Management:                              • Phishing-Resistant MFA:
    Update past iOS 18.5 and Chrome 145.                      Deploy FIDO2/WebAuthn hardware keys.
  • Apple Lockdown Mode:                                              Render stolen session cookies useless
    Disables JIT compilation in WebKit.                               for critical access.
    Blocks advanced browser exploitation paths.                     • Conditional Access Policies:
  • Browser Security Configurations:                                  Require MDM device-health compliance
    Enable Chrome Enhanced Protection.                                before granting token access.
    Restrict third-party script execution.                          • Cloud Session Lifetimes:
                                                                      Reduce refresh token expiration windows.
                                                                      Enforce continuous access evaluation.
                                                  │
                 ┌────────────────────────────────┴────────────────────────────────┐
                 ▼                                                                 ▼
      [Web Supply Chain Defense]                                         [Network Perimeter Defenses]
  • Script Auditing:                                                • Network Threat Hunting:
    Monitor external analytics libraries (Plerdy, DeadTag).   Block `ad.starx-net[.]com:8881`.
  • Subresource Integrity (SRI):                                    • Secure Web Gateways:
    Enforce hash checks on remote scripts.                            Isolate mobile browser traffic.
  • Tag Governance:                                                 • Zero Trust Architecture:
    Remove orphaned tracking domains.                         Revoke active corporate sessions on reboot.

To protect corporate, governmental, and private devices, security teams must address three primary exposure areas:

1. Rapid Operating System and Browser Patching

Every vulnerability chained in Operation Poisoned Source was an n-day bug that both Apple and Google had resolved in software updates prior to the campaign's discovery. Fully updated devices visiting these poisoned pages were immune to exploitation:

iOS Devices: Apple resolved the Class A WebKit and PAC bypass vulnerabilities (CVE-2025-43529 and CVE-2024-27834) in iOS versions 16.7.8 and 17.5. The DarkSword Class B vulnerabilities were patched by Apple in updates through iOS 18.6 and iOS 26.3.
Android Devices: Google patched the V8 engine vulnerability (CVE-2026-3910) in Chrome version 146, while Qualcomm resolved the Adreno graphics driver privilege escalation flaw (CVE-2025-27038) in monthly security bulletins.

Organizations managing mobile fleets must use Mobile Device Management (MDM) platforms to enforce strict operating system compliance, blocking devices running iOS 16.7, iOS 18.5, or Chrome versions 139 through 145 from accessing enterprise resources.

2. Apple Lockdown Mode and Browser Hardening

For users at elevated risk of state-sponsored surveillance—such as government officials, diplomatic staff, defense contractors, and journalists—Apple’s native Lockdown Mode provides effective protection.

When enabled, Lockdown Mode disables WebKit’s just-in-time (JIT) JavaScript compilation, restricts complex web fonts, blocks WebAssembly execution, and eliminates numerous memory optimization routines. Because modern zero-click mobile attack chains rely on JIT compiler type confusion to establish their initial out-of-bounds read and write primitives, Lockdown Mode effectively breaks the first link in these exploit chains.

On Android devices, enabling Enhanced Protection within Google Chrome provides real-time warnings against unverified scripts, while enterprise sandboxes such as Android Enterprise Private Spaces help prevent memory-corrupted browser processes from querying host device keychains.

3. Identity Resilience and Web Script Auditing

Because the campaign's primary objective is harvesting session cookies and authentication tokens, standard password complexity rules offer limited protection:

Phishing-Resistant Hardware Authentication: Organizations should implement FIDO2/WebAuthn hardware security keys, such as YubiKeys. FIDO2 tokens bind cryptographic authentication directly to the origin URL, preventing attackers from authenticating into corporate clouds even if they possess session cookies stolen via browser memory compromises.
Short Session Windows and Device Binding: Identity providers should enforce conditional access policies, binding authentication tokens to specific device health metrics and IP ranges while reducing token lifetimes.
Web Dependency and Tag Auditing: Web developers and site administrators must regularly audit third-party tracking scripts, analytics tools, and marketing tags. Unmanaged dependencies, such as those exposed during the Plerdy intrusion, should be protected using Subresource Integrity (SRI) hashes. SRI ensures browsers automatically reject remote scripts if their cryptographic hash deviates from approved baselines, blunting supply-chain injections before malicious code can run in visitor browsers.

Technical Indicators of Compromise (IoCs)

To assist incident responders, network defenders, and system administrators in detecting and eradicating activity related to Operation Poisoned Source, the following technical indicators have been extracted from researcher telemetry:

Network Indicators (C2 and Telemetry)

ad.starx-net[.]com (Command and Control Host)
ad.starx-net[.]com:8881/telemetry/v12 (Data Exfiltration Endpoint)
america250[.]holiday (AiTM Reverse-Proxy Domain)
a.plerdy[.]com/public/js/click/main.js (Compromised Analytics URI - Aug 27 to Sep 3, 2026)

Chained Vulnerabilities

CVE-2024-27834: Apple Safari / WebKit Pointer Authentication Code (PAC) bypass.
CVE-2025-43529: Apple WebKit dynamic memory out-of-bounds read/write flaw.
CVE-2026-20700 & CVE-2025-14174: Apple Safari sandbox escape via inter-process communication serialization.
CVE-2025-43510 & CVE-2025-43520: Apple XNU operating system kernel privilege escalation.
CVE-2026-3910: Google Chrome V8 JavaScript engine type confusion vulnerability.
CVE-2025-27038: Qualcomm Adreno GPU graphics driver local privilege escalation.

The Strategic Trajectory of Mobile Espionage

Operation Poisoned Source marks an inflection point in state-sponsored cyberespionage. Historically, breaking into modern mobile operating systems was the domain of targeted spear-phishing messages or high-cost zero-day attacks reserved for high-value targets. By pairing watering hole tradecraft with commercial n-day exploit kits, APT29 has operationalized a model that delivers silent compromises at industrial scale.

The weaponization of routine mobile web browsing challenges common consumer security assumptions. For years, mobile users were instructed that avoiding malicious downloads, sideloaded application packages, and untrusted links provided adequate security. Poisoned Source demonstrates that simply visiting a regional news site, browsing a trade association portal, or checking a hotel reservation can silently compromise an unpatched smartphone.

This intelligence pipeline also exposes the broader geopolitical consequences of the commercial spyware industry. Despite aggressive regulatory measures from Western governments—including the U.S. Commerce Department blacklisting surveillance vendors like Intellexa and NSO Group—exploits engineered in private research labs continue leaking into state-sponsored intelligence apparatuses.

As investigators coordinate with national computer emergency response teams across Ukraine, Europe, and the United States to dismantle the starx-net network infrastructure, critical questions remain. Analysts are continuing to investigate why Chrome version 143 was explicitly spared from the exploit matrix, which third-party brokers provided the SVR with the DarkSword chain, and how many sensitive government sessions were compromised through poisoned web trackers.

For modern enterprises and mobile users, the takeaway is stark: personal smartphones and corporate devices share the same digital battlefield. As desktop operating systems harden, state-backed intelligence agencies are turning their sights on mobile browsers. In this environment, delayed software updates are no longer a minor technical oversight—they leave the digital door wide open to automated state-sponsored surveillance.