Skip to content
Hacker Posts

Sekoia ties 'Poisoned Source' mobile watering hole to APT29 via Plerdy supply chain

Sekoia says its 'Poisoned Source' watering-hole campaign served n-day iOS and Android exploit chains via compromised Plerdy SEO Tracker JavaScript, assessed to APT29.

Published 3 min read
apt29supply-chainmobilethreat-intel

Researchers at Sekoia have detailed a watering-hole campaign, which they call Poisoned Source, that delivered mobile exploit chains through a compromised web-analytics script. The primary writeup is Sekoia's blog, Poisoned Source: APT29 watering holes target mobile devices with n-day exploits, authored by Amaury-Jacques Garçon and Félix Aime.

Attribution is hedged: Sekoia "assess[es] with moderate to high confidence that this campaign was conducted by APT29," or at least one of its subgroups. No indictment or sanction makes that official, so treat it as a vendor assessment, not a fact.

What happened

Between 27 August and 3 September 2026, malicious JavaScript was injected into the Plerdy SEO Tracker, a Ukrainian web-analytics component loaded by third-party sites (the tracker's main.js). Visitors to affected sites had browser and device attributes collected, after which delivery infrastructure served a platform-specific exploit chain. Sekoia notes the targeting may have been aimed at specific individuals rather than a broad audience.

Crucially, "all three exploit chains rely entirely on known, already-patched vulnerabilities" — n-days, not zero-days. A patched, current device was not the target.

The chains

Indicators

Sekoia withheld some indicators, including delivery hosts, exfiltration hosts and YARA rules, from the public post. The following appear in the writeup, defanged exactly as published:

Domains:
static.flux-telemetry[.]com
edge-ord.clouds-stacks[.]com
ad.starx-net[.]com
theowo[.]club
america250[.]holiday
adsprism-stat[.]com

IPs:
109.104.106[.]107
95.133.231[.]28
195.58.140[.]105
192.121.46[.]25
188.190.17[.]232

Cookie marker: VDGH_TOKEN_REF

Exfiltration in Class C went to ad.starx-net[.]com:8881/telemetry/v12.

Action checklist

  1. Hunt the domains and IPs above in DNS, proxy and firewall logs back to late August.
  2. Ensure mobile fleets are current — every chain used patched n-days. iOS and Chrome versions below the latest releases are the exposure.
  3. If high-risk users browsed affected sites on unpatched devices, assume browser cookies (and, on Android, saved Wi-Fi passwords) may be compromised; rotate sessions.
  4. For targeted individuals, enabling Lockdown Mode on iOS reduces the attack surface this class of chain relies on.

Context

This is the same playbook Sekoia-tracked actors keep returning to: compromise a widely-embedded third-party script, then fingerprint-and-serve n-day chains to the devices that matter. It pairs with the broader shift toward mobile targeting we noted in Apple's threat notifications to users in 99 countries — the exploitation is increasingly moving to phones, and the delivery increasingly moves through the supply chain rather than a direct lure.

Related stories