APT29 Poisoned Source Watering Hole Attack Explained: Russia-Linked Hackers Spied on Phones Through Hacked Websites

Illustrative image: a person holding a smartphone. This is not a victim's device and not a screenshot of the attack — a watering-hole attack needs no malicious app install, just a visit to a booby-trapped website. Image: Wikimedia Commons, CC BY 2.0.

TL;DR — APT29 Poisoned Source watering hole attack explained in one line: researchers say Russia-linked hackers turned ordinary websites into traps that profiled visitors' phones and silently served exploit chains matched to each device — stealing browser cookies from old iPhones and nearly everything from newer ones — using only flaws Apple and Google had already patched, so an updated phone was never in danger.

📌 KEY HIGHLIGHTS

• The campaign: "Poisoned Source", detected in mid-October 2026 and reported by French security firm Sekoia on 4 November 2026, attributed with moderate-to-high confidence to APT29 (also known as Midnight Blizzard / Cozy Bear), the group Western governments link to Russia's Foreign Intelligence Service (SVR).
• The trick: a watering-hole attack — instead of targeting victims directly, the attackers compromised websites their targets were likely to visit, plus lookalike domains and a hijacked web-analytics script.
• The payloads: three exploit chains, all built from already-patched ("n-day") flaws — Safari cookie theft on iOS 16.7, full device data theft on iOS 18.5 via the DarkSword kit, and Chrome data plus Wi-Fi password theft on Android.
• The CISA link: on the same day, 4 November 2026, CISA added the old Apple WebKit flaw CVE-2024-27834 — one link in the iOS 16.7 chain — to its Known Exploited Vulnerabilities catalogue, with a remediation deadline of 18 November 2026.
• The defence: none of the payloads established persistence, and every flaw in the chains is already patched — updating to the latest iOS, Android and Chrome closes all three chains.

APT29 Poisoned Source watering hole attack explained: what happened?

A watering-hole attack works like its namesake: rather than chasing the prey, the hunter poisons the water it drinks from. Sekoia's researchers found that visitors to a set of compromised and imitation websites were served a small piece of JavaScript that quietly collected their browser and device details. That profile was sent to an attacker-controlled server, which then pushed back an exploit chain built specifically for that visitor's phone and browser version — with no further click or interaction needed after the page loaded.

The campaign used three infection routes. First, genuinely compromised legitimate websites, including a Ukrainian gas producer, a US chemical-industry trade association and a Bulgarian military-related site. Second, lookalike domains impersonating high-profile sites — Sekoia names the official America250 site and Raffles London at The OWO hotel — which relayed content from the real sites in an adversary-in-the-middle arrangement. Third, a supply-chain compromise of the Ukrainian web-analytics service Plerdy: its SEO Tracker script was tampered with between 27 August and 3 September 2026, and that script was loaded by thousands of websites, mostly in Ukraine.

Sekoia's attribution to APT29 rests on similarities to the group's earlier watering-hole operations, overlapping infrastructure, and one compromised site that a partner had linked to a 2025 APT29 campaign. That is a moderate-to-high confidence assessment by one firm, not a courtroom proof — and this post reports it as Sekoia's attribution, not as an established fact. The victimology points the same way: several of the compromised sites are the kind that attract high-value or strategically important visitors in the context of the Russia-Ukraine war, such as army, special-forces and military-equipment (ballistic, UAV) websites.

The three exploit chains: what each phone gave up

Every vulnerability in the three chains was an n-day — a flaw with a patch already available — so only devices running outdated operating-system or browser versions could be infected. Sekoia also found four further vulnerabilities in unreachable code or alternate exploit paths, but those were not used in the chains it analysed.

Target	Flaws used	What was stolen
iOS 16.7	CVE-2025-43529 + CVE-2024-27834	Safari browser cookies, via JavaScript malware
iOS 18.5 (DarkSword chain)	CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520	Full device data: messages, mail databases, voicemail, WhatsApp and Telegram stores, iCloud Keychain, Wi-Fi passwords, contacts, call history, Safari data, photos and health records
Android, Chrome 139–145 (except 143)	CVE-2026-3910 + CVE-2025-27038	Chrome cookies, login data, browsing history and saved Wi-Fi credentials, via the AndroSnitch stealer

The iOS 18.5 chain is the alarming one, and it deserves a careful reading. It relies on DarkSword, a commercial iOS exploit kit first documented in March and used in attacks since at least November 2025 by multiple threat groups. But note what the chain does not do: Sekoia says none of the payloads established persistence, so rebooting a device stopped the malicious activity — until the victim visited a compromised site again. This was an intelligence-gathering operation, built for quiet collection and session hijacking, not for holding a phone permanently.

Illustrative image: server racks in a data centre — the kind of infrastructure behind the attacker-controlled servers that served each visitor a matched exploit chain. Image: Wikimedia Commons, CC0.

Why the CISA listing matters: a 2024 Apple flaw, exploited in 2026

CVE-2024-27834 is a WebKit flaw Apple fixed back in May 2024. On its own it does not break into a phone: CISA describes it as an improper-authentication vulnerability that lets an attacker who already has arbitrary read and write capability in the browser bypass Pointer Authentication, one of the protections that makes iPhone exploits hard to finish. Its CVSS score of 5.5 looks modest — which is exactly why the KEV listing matters. A middling score undersells a flaw's value as one link in a chain, and CISA's catalogue is evidence of real-world exploitation, not severity. The listing covers Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS, and gives US federal civilian agencies until 18 November 2026 to remediate. For everyone else, that date is the right urgency signal, not a legal deadline.

The same lesson runs through this blog's recent exploited-flaw coverage: our Zyxel GS1900 zero-day explainer showed a patch that fixed the wrong bug, and our DreamHost breach coverage showed what happens when an old weakness stays open for months. Poisoned Source is the mirror image: the patches existed, and the only victims were the devices that had not installed them.

Why it matters for World Tech readers

This campaign's targets were specific — visitors to particular military, industry and national sites — so most readers were never in its crosshairs. But its method is general, and that is why it matters beyond the victim list. Watering-hole attacks do not need your email address or your phone number; they need you to visit a website you trust, on a phone you have not updated. The same logic applies to readers in India and everywhere else: a large share of phones in daily use run an OS version several releases behind the latest, and those are precisely the devices n-day chains are built for.

There is also a quieter point for anyone who runs a website. The Plerdy compromise shows how a single tampered third-party script can turn thousands of otherwise innocent sites into delivery vehicles. Site owners should treat third-party scripts as part of their attack surface: pin versions, monitor for unexpected changes, and remove trackers they no longer need.

Should you care?

✅ Yes — for about two minutes, to check your updates. If your iPhone or Android phone and your browser are on the latest available version, these chains do not work against you: every flaw is patched, including fixes Apple pushed even to older iOS releases. ⏳ If you are on an old version — especially iOS 16.7 or 18.5, or Chrome 139–145 on Android — update now, and if you visited any military, defence-industry or Ukrainian site on an outdated device recently, treat saved sessions as exposed: sign out and back in to important accounts and change key passwords after updating.

What to do now

First, update: install the latest iOS or Android version your device supports, and the latest Chrome or Safari. Apple and Google have patched all the flaws in these chains, so the update is the complete fix — there is no setting to change instead. Second, reboot: since the payloads did not persist, a restart clears any active malicious code from an affected visit, though it does not undo data already stolen. Third, if you may have been exposed on an outdated device, rotate credentials for the accounts that matter most — email, banking, messaging — and review active sessions for logins you do not recognise. Finally, for website owners: audit third-party scripts, especially analytics trackers, and remove any you cannot account for.

FAQs

What is a watering hole attack? An attack in which the attacker compromises websites that their intended victims are likely to visit, rather than attacking the victims directly. Visitors to the poisoned site are profiled and served malware matched to their device — in this case, exploit chains that needed no further click after the page loaded.

What is the Poisoned Source campaign? A large-scale watering-hole campaign reported by Sekoia on 4 November 2026 and detected in mid-October 2026, attributed with moderate-to-high confidence to the Russia-linked group APT29. It used compromised legitimate sites, lookalike domains and a tampered Ukrainian analytics script to serve iOS and Android exploit chains built entirely from already-patched flaws.

Is my iPhone affected by the APT29 Poisoned Source attack? Only if it was running an outdated version — iOS 16.7 or 18.5 in the chains Sekoia analysed — and visited a compromised or lookalike site. Updated iPhones are not affected, because Apple has patched every flaw in the chains, including for older iOS releases. If in doubt, update, reboot, and re-check your important account sessions.

What is CVE-2024-27834? A WebKit flaw Apple fixed in May 2024 that lets an attacker with arbitrary read and write capability in the browser bypass Pointer Authentication. CISA added it to its Known Exploited Vulnerabilities catalogue on 4 November 2026, with a federal remediation deadline of 18 November 2026, because Sekoia's campaign used it as one link in its iOS 16.7 exploit chain.

How do I protect my phone from watering hole attacks? Keep your operating system and browser updated — that alone defeats n-day chains like these. Be cautious with unfamiliar lookalike domains, reboot if you suspect a bad visit (these payloads did not persist), and rotate passwords and sessions for important accounts after any suspected exposure.

Takeaway: the scariest part of Poisoned Source is not a new flaw — it is that old, patched flaws still found victims. Update the phone, and the whole chain falls apart.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• BleepingComputer — Hackers use n-day exploits in zero-click attacks on iOS, Android devices (4 Nov 2026, reporting Sekoia's Poisoned Source research)
• The Hacker News — APT29-linked hackers hijack web analytics script to deliver iOS and Android exploits (4 Nov 2026)
• The Circuitry — CISA adds Apple pointer authentication bypass CVE-2024-27834 to exploited list (4 Nov 2026)
• Carthage Electronics — November 4 2026 CVE Threat Brief: Apple CVE-2024-27834 on KEV, Zyxel zero-day, APT flaw