What Happened
Sekoia uncovered Poisoned Source, an APT29 watering hole campaign against iPhone and Android users, The Hacker News reports. Attackers injected JavaScript into compromised sites, lookalike domains, and the Plerdy SEO Tracker analytics service. Malicious code sat in the Plerdy script between August 27 and September 3. The script fingerprints each visitor and serves a matching exploit chain.
The iOS chains reach iOS 16.7 and 18.5. The strongest one, DarkSword, steals messages, Keychain data, Wi-Fi passwords, photos, and chat app data. The Android chain targets Chrome 139 through 145 and installs AndroSnitch, which takes Chrome data and Wi-Fi passwords. The exploits rely on known flaws, so patched devices resist them.
Why This Matters for Canadian Organizations
Canadian defence contractors, federal departments, and NATO-aligned partners sit squarely in APT29’s interest. Staff who browse industry sites on personal or work phones face direct exposure. A trade association site in this campaign shows how ordinary industry portals become delivery tools.
The Plerdy compromise carries a second lesson. One analytics tag reached many sites at once. Canadian organizations load third-party scripts for analytics, chat, and ads, and few review them after launch.
Mobile fleets often lag on updates. Employees who run old iOS releases or an outdated Chrome stay in the target set.
What to Do
Enforce current iOS and Android releases through mobile device management. Turn on Lockdown Mode for staff at high risk of state targeting. Audit every third-party script on your public sites and apply Subresource Integrity or a content security policy where possible. Block the exfiltration domain ad.starx-net.com at your DNS or proxy layer and search logs for it. Brief executives and defence-sector staff on mobile risk. See more Trends coverage and our latest news.
