Russia-Linked APT29 Threat Group Unleashes ‘Poisoned Source’ Campaign Targeting iOS and Android Devices via Supply Chain and Watering Hole Attacks

The notorious Russia-linked threat actor known as APT29 has launched a sophisticated, large-scale watering hole and supply chain campaign dubbed "Poisoned Source." Discovered by French cybersecurity researchers in mid-October 2026, the campaign strategically targets mobile device users across both iOS and Android platforms. By leveraging compromised legitimate websites, fake domains, and a Ukrainian web analytics service, the state-sponsored intrusion set aims to deliver advanced exploit chains capable of harvesting sensitive personal and device data.

According to a technical report published by Sekoia researchers Amaury-Jacques Garçon and Félix Aimé, the malicious operation relies on compromised digital infrastructure to silently profile unsuspecting visitors. The campaign utilizes injected JavaScript code that meticulously collects browser and device attributes before serving platform-specific N-day exploit chains tailored to either Apple’s iOS or Google’s Android operating systems. The ultimate objective of these payloads includes the theft of browser cookies, Wi-Fi credentials, and comprehensive mobile device information.

The scope of the compromised websites involved in the Poisoned Source campaign highlights the strategic and high-value nature of the targeting. Affected platforms include a major industry trade association representing United States companies operating within the chemical sector, a far-right European political party, and a Bulgarian military-related website. Security analysts have noted that several of these web properties naturally attract high-value visitors, particularly military personnel, special forces, and individuals associated with defense equipment sectors, such as ballistics and unmanned aerial vehicles, against the backdrop of the ongoing Russia-Ukraine war.

While cybersecurity experts continue to analyze whether the threat actors intended to indiscriminately compromise any unpatched mobile device visiting the affected pages or selectively targeted specific individuals, the infrastructure points toward an operation optimized for strategic intelligence gathering. Regardless of the entry vector, the attack sequence consistently initiates with a JavaScript loader designed to fingerprint the visitor’s environment and deliver the appropriate subsequent stage of malware.

For mobile users operating Apple devices, the infection chain deploys an exploit kit known as DarkSword, specifically utilizing its P7 variant to harvest browser cookies and deep device data. Conversely, Android users face payloads designed to exfiltrate Chrome browser data and local Wi-Fi passwords without establishing persistent access. Security telemetry indicates that the exfiltrated Android data is systematically routed to a centralized command-and-control endpoint. Notably, the Android attack framework incorporates a specific evasion check designed to inspect device model identifiers; if the target device is identified as a Samsung Galaxy S25 Ultra, the malicious activity immediately terminates.

Researchers have drawn direct parallels between this latest Android activity and previous campaigns, noting similarities to a Chrome cookie-stealing payload documented by Google in August 2024. That earlier operation involved APT29 targeting visitors to a Mongolian government website through a Chrome exploit chain leveraging specific vulnerabilities. Cybersecurity analysts emphasize that the current campaign demonstrates the continued recycling and operational reuse of commercial surveillance vendor mobile exploit frameworks by state-sponsored actors, a practice that significantly lowers the technical barrier and cost required to execute advanced mobile intrusions.

The revelations surrounding APT29’s latest operations arrive closely on the heels of extensive technical analyses published by security firms iVerify, Report URI, and Zimperium zLabs. These investigations have shed light on the broader proliferation and evolution of mobile exploitation toolkits, including the Coruna and DarkSword frameworks, which are increasingly distributed through malvertising infrastructure and compromised advertising tags.

One prominent vector involves what researchers have termed "half-click" attacks propagated through ad networks, such as malicious social media advertisements themed around major international events like the World Cup. Another significant pathway, identified as the DeadTag campaign, involves threat actors acquiring expired domains tied to legacy analytics and advertising tags that remain embedded across thousands of active websites. These abandoned tags silently inject malicious JavaScript when loaded by unsuspecting visitors, effectively turning forgotten website infrastructure into a widespread malware delivery network.

Security researchers emphasize that these sophisticated toolkits bypass traditional social engineering tactics entirely, requiring no user interaction beyond navigating to a compromised page. The scripts actively filter incoming traffic, ignoring search engine crawlers, automated security scanners, and bots while singling out genuine mobile users. When a vulnerable mobile device visits a participating site, the exploit kits break out of the browser sandbox and install spyware depending on the underlying operating system version.

While legacy frameworks like Coruna were originally engineered by state-sponsored actors for highly targeted surveillance operations, their subsequent disclosure and partial leaks have resulted in broader adoption across various malicious ecosystems. Distribution networks have expanded to span dating portals, artificial intelligence companion platforms, cryptocurrency promotional sites, and mainstream media streaming services. As threat actors continue to refine these automated delivery mechanisms, security agencies and researchers stress the critical importance of prompt software updates and robust endpoint monitoring to mitigate the growing risks posed by N-day mobile exploit kits.