Sekoia reports Poisoned Source mobile spyware campaign

Sekoia said it discovered a mobile spyware campaign called Poisoned Source in mid-October 2026, using compromised and impersonation websites to deliver exploits to visitors’ iOS and Android devices. The researchers assessed with moderate-to-high confidence that the operation was linked to APT29, but the attribution remains their assessment, based on similarities to earlier activity, infrastructure overlaps and information from a partner. The campaign used three routes: attackers injected malicious JavaScript into legitimate websites, created fake sites copying real organisations, and compromised Plerdy’s web analytics tracker. Sekoia said the tracker was compromised from August 27 to September 3, 2026. Its script was loaded by thousands of websites, most of them in Ukraine, exposing visitors to the malicious code during that period. The affected and impersonated sites included organisations in the United States, Ukraine, the Czech Republic and Bulgaria. Sekoia identified compromised sites connected to a Ukrainian gas producer, a U.S. chemical industry association and a Bulgarian military-related site. Fake websites copied the America250 initiative and Raffles London at The...