Poisoned Source (APT29): Plerdy analytics hijack serves iOS and Chrome n-day exploit chains (CVE-2026-3910)
Severity: high · Patch status: patched · Since 2026-11-04 · CVE-2024-27834, CVE-2025-14174, CVE-2025-27038, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700, CVE-2026-3910
Sekoia's Threat Detection & Research team found the 'Poisoned Source' campaign in mid-October 2026 and published its write-up on 2026-11-04. Sekoia assesses with moderate to high confidence that APT29 (also tracked as Midnight Blizzard or Cozy Bear, linked to Russia's SVR) conducted it. Three delivery routes were used: script injection on compromised websites (a US chemical-industry trade association, a far-right European political party, a Bulgarian military-related site, a Ukrainian gas producer, and others), lookalike domains imitating America250 and a Raffles London hotel site, and a supply-chain compromise of the Plerdy SEO Tracker script (a.plerdy[.]com/public/js/click/main.js), which thousands of mostly Ukrainian sites load, between 27 August and 3 September 2026. The compromised script reached army, special-forces and military-equipment sites. A device-profiling loader serves a platform-specific chain: iOS 16.7 cookie theft; iOS 18.5 full-device collection through the DarkSword framework (SMS and iMessage, WhatsApp and Telegram databases, Wi-Fi keys, Keychain); and Chrome 139 to 145, excluding 143, which runs AndroSnitch to collect Chrome data and Wi-Fi passwords. Sekoia reports no persistence and sends the data to ad.starx-net[.]com. Sekoia says each exploited flaw was resolved by its vendor before the campaign began. Sekoia gives no victim or device counts, does not say how Plerdy responded, and thanks CERT-UA for collaboration.
What to do
- Ensure all mobile devices (iOS and Android/Chrome) are fully updated to current patched versions
- Review whether your sites embed the Plerdy SEO Tracker script (a.plerdy[.]com/public/js/click/main.js) or other third-party analytics scripts, and audit them for injected code
- Deploy CSP and subresource integrity where feasible to detect and limit malicious script injection on web properties
- Monitor for connections to ad.starx-net[.]com:8881/telemetry/v12 and related infrastructure
- Hunt for signs of compromise on iOS and Android devices used by high-risk staff
- Block lookalike domains such as america250[.]holiday and monitor for typosquatted high-profile sites
Sources
All live incidents on Threat Watch
