Sekoia Assesses APT29 Link to iOS and Android Attacks

Sekoia’s November 4, 2026 report describes “Poisoned Source,” a mobile campaign it assesses with moderate-to-high confidence was conducted by APT29 or a subgroup. The operation used three routes to deliver exploits aimed at specific iOS and Android Chrome versions. “No-click” meant the targeted exploit chains required no further user action after a page loaded; it did not mean every visitor was infected. Sekoia’s technical report

“No-click” describes the step an exploit skips, not a guarantee that every visitor is a target.

How the campaign reached mobile browsers

Sekoia describes three delivery routes: malicious JavaScript added to compromised legitimate websites, attacker-run reverse proxies that imitated real sites, and a compromised Plerdy analytics tracker. That tracker was compromised from August 27 through September 3, 2026. Sekoia says its investigation began in mid-October, after its team found a malicious JavaScript inclusion on a Ukrainian gas-production company’s website.

The injected code profiled browser and device details. The delivery infrastructure used those details to select a platform-specific exploit chain, which could run without another tap or click after the page loaded. Sekoia says the UltimateFingerprinter script used 61 collectors to assemble 394 fields, but found no evidence that the broader fingerprint data affected exploit delivery beyond basic plausibility checks.

Three chains targeted different software

Sekoia describes two iOS chains and one for Android Chrome. The first iOS chain’s delivery filter was iOS 16.7 or 16.7.10, although Sekoia says the exploit could work on iOS 16.0–17.4. That broader compatibility range does not mean the server targeted every version in it.

Sekoia says the iOS 18.5 chain could collect messages, messenger databases, stored credentials and tokens, Wi-Fi passwords, contacts, call history, location and health data, photos, and files in iCloud Drive. The Android chain targeted Chrome data, including saved logins and browsing history, as well as Wi-Fi configuration data. Sekoia says that chain stopped if it detected a Samsung Galaxy S25 Ultra.

Sekoia’s findings on attribution and patches

Sekoia bases its moderate-to-high-confidence assessment of APT29 or a subgroup on technical overlap, operational patterns, victimology, and infrastructure. That is Sekoia’s technical assessment, not a government attribution of the campaign.

Sekoia says the vulnerabilities in all three analyzed chains were known and had been patched by their vendors before the campaign. Its analysis found no persistence established by those chains.