APT29 'Poisoned Source' Watering Holes Hit iPhones and Android Phones With n-Day Exploit Chains — CISA Adds Apple CVE-2024-27834 to KEV
A Russia-linked campaign used hacked websites, lookalike domains and a tampered Plerdy analytics script to serve three already-patched exploit chains that stole messages, Keychain data, cookies and Wi-Fi keys from out-of-date iOS and Android devices.
What Happened
Security researchers have exposed a watering-hole campaign, dubbed "Poisoned Source", that served exploit chains to iPhones and Android phones visiting legitimate websites. The researchers attribute it with moderate to high confidence to APT29 (also tracked as Midnight Blizzard, Cozy Bear and The Dukes), the Russian state-linked espionage group, or a subgroup of it.
The findings, published on 4 November 2026, quickly reached official channels. The same day, CISA added CVE-2024-27834, an Apple flaw used in one of the iOS chains, to its Known Exploited Vulnerabilities (KEV) catalogue. US federal civilian agencies have until 18 November to patch.
Every vulnerability in the chains is an n-day, a flaw already patched. The researchers say a fully updated device was not affected.
How Victims Were Reached
The operators used three ways to put malicious JavaScript in front of mobile visitors:
- Compromised legitimate websites, including a Ukrainian gas producer, a US chemical-industry trade association, a far-right European political party, a Bulgarian military-related site and an Australian medical clinic.
- Lookalike domains that proxy the real site in an adversary-in-the-middle style, such as
america250[.]holiday, which mirrors the US 250th-anniversary initiative, andtheowo[.]club, which mirrors a London hotel near UK government buildings. The domains were registered in May and June 2026. - A supply-chain compromise of Plerdy, a Ukrainian SEO and analytics tracker used by thousands of mostly Ukrainian websites, including military and defence-related ones. The tracker script at
a.plerdy[.]comwas tampered with for one week, from 27 August to 3 September 2026.
The injected code loads a fingerprinting script that collects 394 data points from 61 collectors, covering canvas, WebGL, fonts, sensors and Apple-specific features. The delivery server then picks an exploit based on operating system and browser version. Only a few checks block delivery, such as implausible screen dimensions or a device with no touch support, so the researchers could not tell whether victims were chosen in advance or collected broadly and filtered later.
Technical Details
The researchers recovered three exploit chains:
- iOS 16.7 chain (Class A): uses CVE-2025-43529 together with a pointer authentication (PAC) bypass built on CVE-2024-27834 to forge the pointers needed for code execution. The researchers say it works on iOS 16.0 through 17.4, and its goal is to steal Safari and app cookies.
- iOS 18.5 chain (Class B): chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520, and is linked to DarkSword, a suspected commercial-surveillance exploit kit. Its final stage collects SMS, iMessage, WhatsApp and Telegram messages, Keychain items, Wi-Fi keys, Safari history, contacts, call logs, location caches, Health data, photos and iCloud Drive content.
- Android chain (Class C): targets Chrome 139 to 145 (oddly skipping 143) using CVE-2026-3910 in Chrome and CVE-2025-27038 in a Qualcomm component. The payload, named AndroSnitch, steals Chrome cookies, saved logins and browsing history, plus Wi-Fi configuration files, and sends them out with libcurl.
None of the final payloads establishes persistence, so a reboot ends the infection. That does not undo the theft: cookies, credentials and messages taken in one visit stay useful long after.
The researchers believe the exploits most likely came from a commercial surveillance vendor rather than being built in-house.
Indicators (defanged)
Partial indicators shared publicly:
- Delivery:
static.flux-telemetry[.]com(109.104.106[.]107),edge-ord.clouds-stacks[.]com(95.133.231[.]28) - Exfiltration:
ad.starx-net[.]com(195.58.140[.]105), port 8881, path/telemetry/v12 - Lookalike domains:
theowo[.]club,america250[.]holiday - Other delivery domains:
ads-it-assets[.]com,cdn.adv-static[.]com,wpvortex-mod[.]com,assets-int[.]com
The full indicator set is shared only with CERTs and law enforcement.
Who Is Affected
Anyone who visited an affected site on an out-of-date phone. Given the victim sites, the likely interest is Ukrainian energy and defence, European politics, US industry and diplomacy-adjacent circles. iPhones still on iOS 16 or 17, which many older devices cannot move past, are especially exposed.
What To Do Now
- Update iOS, Android and Chrome. Unsupported iPhones should be retired from any role that touches sensitive data.
- Turn on Lockdown Mode on iPhones for high-risk staff such as executives, diplomats, journalists and defence personnel.
- Enforce minimum OS versions through mobile device management, and block access to corporate resources from non-compliant devices.
- Rotate sessions and passwords for users whose unpatched phones may have visited the listed or affected sites, and revoke saved Wi-Fi keys where relevant.
- Block the indicators above in DNS and proxy logs, and search back to May 2026 for hits.
- Audit third-party scripts on your own websites. The Plerdy case shows how one analytics tag can turn thousands of sites into delivery points. Use Subresource Integrity and a strict Content Security Policy where you can.
Why It Matters
The campaign shows that state actors no longer need zero-days to reach phones. They can buy or borrow commercial n-day chains and rely on the large population of devices that lag behind on updates. The CISA listing of a 2024 Apple bug in late 2026 makes the same point: an old vulnerability is still dangerous while unpatched devices remain in use.
