APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

Key Points:

• APT29, a Russia-linked threat actor, has launched a large-scale watering hole campaign targeting iOS and Android users via compromised websites, fake domains, and a supply chain attack involving the Ukrainian Plerdy SEO Tracker service.
• The campaign, named Poisoned Source, uses injected JavaScript to profile devices and deliver platform-specific exploits, aiming to steal browser cookies, Wi-Fi passwords, and full mobile device data, especially from high-value targets related to the Russia-Ukraine conflict.
• Three distinct exploit classes target iOS versions 16.7 and 18.5, and Android Chrome versions 139-145 (excluding 143), leveraging multiple CVEs to execute malware like DarkSword and AndroSnitch for data exfiltration to a command-and-control endpoint.
• The campaign reuses commercial surveillance vendor exploit frameworks such as DarkSword and Coruna, which have evolved and spread through malicious ads, expired domains, and half-click attacks, compromising devices without user interaction.
• These exploit kits target vulnerable iOS browsers by breaking out of the browser sandbox to install spyware, with campaigns distributing these kits found across diverse lure sites including dating portals, cryptocurrency promotions, and compromised legitimate websites.