A Russian state espionage group quietly turned a popular piece of website tracking code into a phone-hacking delivery system — and the whole attack needed exactly one thing from you: visiting an affected page. No click. No download. No password. If your phone wasn’t fully updated, your cookies, saved logins and even your Wi-Fi password could have been siphoned off without you ever knowing.

Security firm Sekoia published research on November 5, 2026 detailing a campaign it calls “Poisoned Source,” attributed with moderate-to-high confidence to APT29 — the Russian group also known as Cozy Bear and Midnight Blizzard. It’s a textbook example of why both website owners and everyday users need to take patching seriously, because every flaw used in this attack was already fixed.

What Happened

Between August 27 and September 3, 2026, the attackers compromised Plerdy, a Ukrainian website analytics and SEO tracker, and planted malicious code inside its script served from a.plerdy.com. For roughly a week, thousands of sites — most of them Ukrainian — loaded that poisoned tracker in their visitors’ browsers without anyone noticing.

The attackers used a few other routes too: they injected scripts directly into legitimate websites and built lookalike domains — including the US-facing america250[.]holiday — that proxied real sites while quietly adding their payload. Once the malicious JavaScript loaded, it profiled each visitor’s browser and operating system and served a matching exploit chain.

The Three Exploit Chains

Three distinct chains covered unpatched iPhones and Android devices:

• iOS 16.7 and 17.0–17.4: CVE-2025-43529 (WebKit code execution) chained with CVE-2024-27834 (pointer-authentication bypass) stole Safari and app session cookies.
• iOS 18.5: The five-flaw “DarkSword” chain grabbed extensive device data — messages, email, WhatsApp and Telegram databases, iCloud Keychain items, photos, call history and Wi-Fi passwords.
• Android (Chrome 139–145, minus 143): CVE-2026-3910 in the renderer and CVE-2025-27038 in the Adreno driver escaped the sandbox, then a payload called “AndroSnitch” harvested Chrome cookies, saved logins, browsing history and Wi-Fi passwords.

Why This Matters Even After the Sites Are Cleaned

Two details make this campaign worth taking seriously long after it ended.

First, every single vulnerability they used was an n-day — already publicly disclosed and patched. Sekoia found that none of the chains worked against a fully updated device. In other words, patching wasn’t a mitigation here; it was the entire defense.

Second, the payloads were designed for maximum damage per victim. A stolen session cookie lets an attacker open your accounts without your password until the session expires or is revoked. A leaked Wi-Fi password puts the attacker on your home network, behind your router firewall — a prize that keeps paying out after the campaign wraps.

What You Should Do Now

This is one of those rare cases where the defense is simple and the window to act is right now:

• Patch your phone today. Check Settings on your iPhone or Android device and install any pending OS update. Update Chrome from the Play Store as well. Confirm both are current. That single step neuters these chains.
• Audit the scripts on your website. Every third-party script — analytics, trackers, ad code, chat widgets — is a potential supply-chain entry point. Load fewer of them, and consider Subresource Integrity (SRI) in your script tags so a tampered file fails to load.
• If you think you were exposed — or you used Plerdy analytics on a site you run — sign out of your accounts on all devices (this revokes those stolen session cookies), change passwords for important accounts, enable multi-factor authentication, and change your home Wi-Fi password.
• Remember MFA doesn’t stop a stolen cookie. A hijacked session bypasses your password and your MFA prompt. That’s why signing out everywhere matters after a campaign like this.

APT29, the Plerdy compromise, the lookalike domains — all of that is behind a fix that was sitting on your shelf the whole time. Turn off “I’ll update it later.” Update your phone now.