November 5, 2026
- APT29 "PoisonedSource" watering holes delivered zero-click n-day chains to iOS and Android. Sekoia attributes with moderate-to-high confidence; the actor compromised Ukrainian web analytics provider Plerdy and modified its SEO tracker — loaded by thousands of mostly Ukrainian sites between August 27 and September 3 — alongside a Ukrainian gas producer, a US chemical trade association and a Bulgarian military site, plus AitM lookalikes of America250 and Raffles London. Profiling JavaScript selected the chain: Safari cookie theft on iOS 16.7 (CVE-2025-43529, CVE-2024-27834); WhatsApp/Telegram databases, Keychain credentials, location and photos on iOS 18.5 (five CVEs); and AndroSnitch against Chrome for Android 139–145, excluding 143 (Sekoia, BleepingComputer). · Threat Activity