Kremlin-Linked Hackers Deploy Mobile Exploit Chains to Spy on Foreign Diplomats

A sophisticated cyberespionage campaign linked to Russia's Foreign Intelligence Service has successfully compromised targeted iOS and Android devices without requiring any user interaction. The operation transformed legitimate websites into silent traps, extracting sensitive communications, passwords, and location data from high-value visitors across Europe and the United States.[1][3]

French cybersecurity firm Sekoia uncovered the sprawling surveillance effort in mid-October 2026, designating the malicious activity under the codename "Poisoned Source." Researchers attributed the campaign with moderate to high confidence to APT29, a notorious state-sponsored hacking collective that is also widely tracked as Midnight Blizzard or Cozy Bear.[2][5]

Rather than relying on traditional phishing emails, the attackers utilized a strategic technique known as a watering hole attack. By compromising specific websites frequently visited by their intended targets, the operatives could silently profile visitors and deliver tailored exploitation code directly through the victim's mobile browser.[1][5]

"The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and Félix Aime explained in their technical report. "Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android." The script checks the exact operating system version before proceeding.[2]

Supply Chain and Lookalike Domains

The campaign relied on three distinct delivery vectors to cast its net, including the direct injection of malicious scripts into vulnerable but legitimate websites. The compromised sites included a major United States chemical industry trade association, a Czech far-right political movement, and a Bulgarian military organization.[1][5]

The most expansive and damaging vector involved a supply chain attack against Plerdy SEO Tracker, a widely used Ukrainian web analytics service. Between August 27 and September 3, 2026, the attackers successfully hijacked the tracker's core infrastructure to serve malicious code to thousands of downstream websites.[2][5]

AI

Because Plerdy is heavily utilized by organizations within Ukraine, the supply chain compromise exposed hundreds of sensitive domestic targets to the exploit infrastructure. Visitors to websites operated by a Ukrainian gas production company, the national military, and domestic defense equipment manufacturers were all subjected to the malicious profiling script.[1][5]

The third delivery method utilized sophisticated lookalike domains designed to impersonate high-profile organizations and physical locations. One such fraudulent domain closely mimicked the America250 initiative, a prominent organization that is currently coordinating the upcoming 250th anniversary of the signing of the United States Constitution.[5]

Another fraudulent domain impersonated Raffles London at The OWO, a luxury hotel frequently utilized by diplomatic delegations and international officials. Security analysts noted that Ukrainian President Volodymyr Zelensky stayed at the property on October 14, suggesting the clone was specifically engineered to target visiting dignitaries and their support staff.[5]

Platform-Specific Exploitation

Once the JavaScript profiler identified a vulnerable mobile device, it silently redirected the browser to a secondary infrastructure that delivered the actual exploits. The campaign specifically utilized "n-day" vulnerabilities—known security flaws that Apple and Google had already identified, documented, and patched in recent software updates.[3][5]

For Apple users running iOS 16.7, the attackers deployed a precise exploit chain chaining CVE-2025-43529 and CVE-2024-27834. This specific combination allowed the operatives to silently extract browser cookies, enabling them to hijack active webmail sessions and bypass authentication prompts without triggering any security warnings.[3][5]

Devices running the newer iOS 18.5 faced a significantly more aggressive assault powered by the DarkSword exploit kit. This comprehensive package leveraged five distinct vulnerabilities—CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520—to achieve deep system access and bypass Apple's stringent sandbox protections.[3][5]

AI

The DarkSword payload extracted nearly every piece of sensitive personal and professional data stored on the targeted iPhone. The exfiltrated information included SMS records, iMessage databases, WhatsApp and Telegram archives, Keychain passwords, precise location history, and personal photographs, providing the attackers with a complete intelligence profile.[3][5]

Android users were targeted through a separate, highly specialized exploit chain aimed at devices running Google Chrome versions 139 through 145, with the notable exception of version 143. This pathway utilized CVE-2026-3910, a severe flaw in the Chrome browser, alongside CVE-2025-27038, a vulnerability in the Adreno graphics driver.[3][5]

The AndroSnitch Payload

The Android exploitation chain culminated in the deployment of a custom data-harvesting payload that Sekoia researchers dubbed "AndroSnitch." This tool systematically collected Chrome cookies, saved login credentials, comprehensive browsing history, and stored Wi-Fi passwords from the compromised handset before transmitting them to a remote command server.[2][5]

AndroSnitch shares significant architectural similarities with a previously documented Chrome cookie-stealing payload known as ANDROSNATCH. Google's Threat Analysis Group previously linked that earlier tool to an August 2024 APT29 watering hole campaign that targeted a Mongolian government website using a similar combination of browser vulnerabilities.[2]

Unlike traditional mobile malware, none of the payloads deployed in the Poisoned Source campaign installed persistent backdoors or tracking applications. Once the targeted data was successfully transmitted to the attackers' servers, the exploitation activity terminated immediately and left no active malicious processes running on the device.[3]

This ephemeral approach makes the campaign exceptionally difficult for traditional mobile security solutions to detect or block. Because the malicious code only exists in the device's memory during the active browsing session, forensic investigators are often left with minimal artifacts to analyze after the exfiltration is complete.[3]

AI

The Commercial Spyware Connection

The deployment of the DarkSword exploit kit highlights a growing convergence between state-sponsored intelligence operations and the commercial spyware industry. Sekoia assesses that DarkSword was originally developed by a commercial surveillance vendor before being acquired, licensed, or repurposed by Russian intelligence operatives for this campaign.[2][5]

"This operation also confirms the continued reuse of CSV mobile exploit frameworks, such as DarkSword, by state-sponsored intrusion sets," the French cybersecurity firm noted in its technical analysis. The commoditization of these advanced tools allows intelligence agencies to deploy top-tier capabilities without spending years developing them in-house.[2]

The campaign's reliance on n-day exploits underscores the critical importance of immediate software updates for high-risk individuals and government officials. Because Apple and Google had already issued patches for all eight vulnerabilities utilized in the attacks, devices running fully updated operating systems were completely immune to the exploit chains.[3][5]

However, the success of the operation demonstrates that patch deployment remains dangerously fragmented, even among well-resourced government and corporate targets. The inevitable window between a security patch's release and its widespread installation provides attackers with ample time to compromise high-value devices before they are secured.[1][3]

Bypassing Traditional Defenses

The Poisoned Source campaign represents a significant evolution in APT29's tactical playbook and operational sophistication. While the group has historically relied heavily on targeted email phishing campaigns to harvest credentials, the shift toward mobile watering holes indicates a strategic desire to bypass modern email security gateways entirely.[1][2]

By compromising the websites that diplomats, military officials, and industry leaders naturally visit during their daily routines, the attackers eliminate the need to trick victims into clicking suspicious links. The mere act of loading a trusted webpage on an outdated device is sufficient to trigger a catastrophic data breach.[3][5]

As mobile devices increasingly serve as the primary repository for sensitive corporate and diplomatic communications, state-sponsored actors will continue to prioritize mobile exploitation. Defending against these silent, zero-click web attacks requires organizations to enforce strict, immediate update policies across all employee hardware to close the vulnerability window.[1][5]