There was nothing new about the weapons. That is the point. In mid-October 2026, researchers at the French cybersecurity firm Sekoia found a large watering-hole campaign — booby-trapped websites serving exploit chains to visitors’ phones without a single click — and every flaw it exploited had already been patched. The campaign, which Sekoia calls Poisoned Source, did not need a zero-day. It needed only a phone running the affected software that hadn’t been updated.
A visit was enough
The mechanics were quiet. A visitor opened an ordinary-looking page on an iPhone or an Android phone, and JavaScript injected into the traffic began profiling the device — its browser, its version, its shape. That profile decided what came next: one of three exploit chains, matched to the platform, delivered without the visitor clicking, tapping, or doing anything at all. The payloads were built to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data. Sekoia, which published its findings on November 4, 2026, says the campaign targeted visitors through websites in the United States, Ukraine, the Czech Republic and Bulgaria.
Three ways in
The attackers did not rely on a single trick. They used three routes to the same first step: the profiling JavaScript that sized up each visitor’s device. What came after differed by platform. The first was the oldest one in the book: breaking into legitimate websites and injecting the malicious script into their traffic. Among the compromised sites were a top Ukrainian gas production company, a U.S. chemical industry trade association and a Bulgarian military-related site. The second route was imitation: lookalike domains that acted as reverse proxies, fetching the real page and slipping the script in on the fly. The third was the supply chain. Between August 27 and September 3, 2026, the attackers compromised Plerdy SEO Tracker, a Ukrainian web analytics service used by thousands of mostly Ukrainian sites, injecting malicious code into its tracking script — turning every site that loaded it into a potential trap.
The three exploit chains
Whichever door a visitor came through, the next step was the same: the profiling script, then a chain chosen for the device. On iPhones running iOS 16.7, the attackers used two flaws — CVE-2025-43529 and CVE-2024-27834 — to deliver JavaScript malware that stole cookies, the kind of theft that lets an attacker reuse a logged-in session, webmail included. On iPhones running iOS 18.5, they used DarkSword, a commercial iOS exploit kit that chained five flaws together and harvested nearly everything on the phone: messages, mail databases, WhatsApp and Telegram stores, iCloud Keychain passwords, Wi-Fi passwords, contacts, call history, location data, Safari data, photos and health records. On Android phones running Chrome versions 139 through 145 — version 143 excluded, for reasons Sekoia and the reporting outlets do not explain — two flaws delivered the AndroSnitch stealer, which collected Chrome data and saved Wi-Fi passwords after achieving remote code execution, a sandbox escape and privilege escalation. None of the three payloads established persistence: a reboot stopped the malicious activity, at least until the user visited a compromised site again.
The weapon was the gap
Here is the part that should unsettle anyone who puts off updates. Every one of those flaws was an n-day — a vulnerability with a patch already in the world before the campaign began. Several carry severity scores of 8.8 out of 10. And a fully updated phone was not exposed to these chains at all. The campaign’s power did not come from secret knowledge. It came from the distance between a patch existing and a device receiving and installing it — a gap that can open when an update is postponed, but also when a manufacturer or carrier has not shipped the fix to that phone yet. DarkSword itself tells the same story from the other side. The kit was first documented in March and has been used in attacks since at least November 2025 by multiple threat groups; Google researchers said customers of PARS Defense, a Turkish commercial surveillance vendor, and at least two other threat actors have used it. Sekoia’s observation is blunt: the reuse of packaged commercial exploit frameworks by state-backed groups lowers both the cost and the technical bar for running advanced mobile intrusions. If Sekoia’s attribution is right, the group behind this campaign did not need to build the weapon from scratch. The pieces were already on the market.
The bait
Some of the lures were chosen for the people they would attract — or so it may be. One lookalike domain, america250[.]holiday, mirrored the site of America250, the nonpartisan group marking the 250th anniversary of American independence, delivering the genuine content with the profiling script added. Did the attackers deliberately choose the anniversary site because of the celebration, hoping to catch officials and diplomats with invitation-themed spear-phishing? Sekoia assessed that they may have — an assessment, not a confirmed fact. A second lookalike domain, theowo[.]club, proxied the site of Raffles London at The OWO, a luxury hotel a short walk from the Ministry of Defence and 10 Downing Street. Open-source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14. Did the attackers set that trap for diplomatic delegations and high-profile guests? Sekoia said they may have sought to — again, an assessment, not a confirmed fact. The questions matter more than the answers would flatter anyone: the campaign’s most telling choices may have been about who would walk through the door, not how the door was built.
What Sekoia thinks it knows — and what it doesn’t
Sekoia attributes the campaign to APT29 — also tracked as Midnight Blizzard and Cozy Bear, and widely linked to Russia’s Foreign Intelligence Service — with moderate to high confidence. That is the firm’s assessment, and it should be read as one. The basis is circumstantial but specific: traces of a 2025 APT29 watering-hole operation found on one of the compromised sites, similarities with a 2024 APT29 campaign against Mongolian government websites that Google’s Threat Analysis Group confirmed, and a victim list centered on Ukraine. What Sekoia does not claim is equally important. No count of infected phones has been published, and no specific victims have been named. The firm says it remains unclear whether the attackers meant to target visitors to particular websites, or simply to compromise as many unpatched mobile devices as possible and sort through the haul afterward. The full extent of any data theft is unknown.
The fix already exists
The campaign is a story about a defense that already exists and mostly works. The flaws were fixed. The chains could reach only devices running the affected versions that had not been updated — and whether a given phone had the fix was not always the owner’s doing: manufacturers and carriers can delay patches, and the responsibility for the attack sits with the attackers, not with the people whose phones were exposed. Where the update is available, the advice is simple: install it. It will not feel like security work. It will feel like a restart you didn’t want, a few minutes of waiting, a phone that comes back slightly different. On the evidence of this campaign, that small act is the difference between exposure and safety.
