Sekoia’s investigation, published November 4, 2026, describes Poisoned Source as a mobile campaign with three delivery routes: injected code on legitimate websites, lookalike reverse-proxy sites, and a compromised Plerdy analytics tracker. A visit to an affected page was enough to start the chain; Sekoia says no further click or download was required. Sekoia’s investigation says the team uncovered the activity in mid-October.

How Poisoned Source reached mobile devices

On legitimate websites, attackers injected JavaScript. Lookalike sites worked as reverse proxies, relaying and modifying web pages. The third route came through Plerdy’s compromised analytics tracker: sites that loaded it could also load the attackers’ fingerprinting script. In each case, the script checked the visitor’s device and browser before directing matching configurations to an exploit chain.

What the 394-field fingerprint tells us

The custom script, called UltimateFingerprinter, used 61 collectors to assemble 394 JSON fields. Sekoia observed basic checks of screen width, screen height, and touch-point count that could block delivery when the values looked implausible. It found no evidence that most of the other collected fields affected exploit delivery or were reused later in the infection chain.

For this campaign, information collected is not the same as information shown to affect exploit delivery.

The reported iOS and Android exploit chains

Sekoia described three chain classes, each tied to a specific set of vulnerabilities and device or browser configurations:

  • Class A, iOS: Sekoia’s summary identifies iOS 16.7. Its technical analysis says the chain should work on iOS 16.0–17.4, while the delivery server filtered for iOS 16.7 and 16.7.10. The chain used CVE-2025-43529 and CVE-2024-27834, and sought browser and app cookies.
  • Class B, iOS 18.5: This chain used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. Its payload sought messages, mail and voicemail, messenger databases, credentials and tokens, Wi-Fi credentials, contacts, call history, calendar and notes, location-related caches, and media.
  • Class C, Android Chrome: This chain targeted Chrome versions 139–145, excluding 143, and used CVE-2026-3910 and CVE-2025-27038. Its payload sought Chrome cookies, saved logins and history, plus Wi-Fi configuration data and passwords.

Sekoia says all three chains relied on known vulnerabilities that had been patched and would not work against fully updated devices. The observed payloads did not establish persistence.

What Sekoia assessed about the operator

Sekoia assessed with moderate-to-high confidence that APT29 or one of its subgroups conducted Poisoned Source. It based that assessment on technical overlaps, operational patterns, victimology, and infrastructure.

Plerdy’s website exposure and the device count

Sekoia dates the compromise of Plerdy’s tracker to August 27 through September 3, 2026. It says the tracker was loaded by thousands of websites, most of them in Ukraine, and separately describes hundreds of legitimate websites as exposed. The number of successfully compromised devices was unknown.