Interfaz en español. Las fichas, los resúmenes y las fuentes conservan su idioma original.

Mobile users visiting compromised or impersonated websites

Poisoned Source: mobile exploits target cookies and private data

CVE-2025-43529 CVE-2024-27834 CVE-2026-20700 CVE-2025-14174 CVE-2025-43510 CVE-2025-43520 CVE-2026-3910 CVE-2025-27038Actualizado 4 nov 2026

Revisar esta semanaInforme de investigación

Seguí las novedades de seguridad

Alertas prioritarias y resúmenes de Radar por correo.

.rd-subscription-header button,#radar-email-form{display:none!important}

Suscribite con tu correo. La activación requiere confirmación por email.

Análisis de amenazas

Sekoia recovered three mobile exploit chains delivered through compromised or impersonated websites, with payloads capable of stealing cookies and private data. The report attributes Poisoned Source to APT29 with moderate to high confidence; it does not establish a count of compromised phones.

Quiénes deben revisar: Teams responsible for mobile devices and identity security, especially users with sensitive access who may have visited the websites or infrastructure documented by Sekoia.

Acción recomendadaCorrección disponible

Verify OS, browser and device security updates. If evidence indicates compromise, preserve logs and coordinate session revocation and credential recovery from a trusted device; installing updates alone does not invalidate stolen sessions.

Revisar sistemas afectados Armar un plan de respuesta

¿Qué ocurrió y por qué es relevante?

Poisoned Source reaches mobile browsers through legitimate websites modified by attackers, impersonated sites and a reported compromise of the Plerdy analytics service. Sekoia discovered the activity in October 2026 and recovered three complete exploitation chains with their final payloads. These observations establish delivery and capabilities, not how many phones were successfully compromised.

The recovered chains target specific profiles: iOS 16.7, iOS 18.5 and selected Chrome versions on Android. Capabilities range from cookie theft to collection of messages, credentials and other private data. Android exploitation also depends on an Adreno GPU driver vulnerability. The delivery profiles below are not a universal affected product matrix.

Sekoia says the analyzed chains use vulnerabilities patched before this campaign and do not work against fully updated devices. This does not establish a safe build for every legacy model. Verify the fixes available for the exact device and restrict sensitive access where necessary updates are unavailable.

Attribution to APT29, or a subgroup, is Sekoia's assessment with moderate to high confidence. Vendor patch notices and Google's earlier DarkSword research provide technical context; they do not independently confirm this campaign's attribution or victim count. Website exposure should not be presented as a count of infected phones.

For organizations, patch coverage and account recovery are separate tasks. Oktsec recommends reviewing update coverage this week and responding immediately to credible local evidence. Where sessions or credentials may have been stolen, coordinate revocation and recovery from a trusted device; patching alone does not restore account control.

Sector afectado: Mobile users visiting compromised or impersonated websites
Identificadores de vulnerabilidad: CVE-2025-43529 · CVE-2024-27834 · CVE-2026-20700 · CVE-2025-14174 · CVE-2025-43510 · CVE-2025-43520 · CVE-2026-3910 · CVE-2025-27038
Divulgado: 4 nov 2026
Última revisión de evidencia: 4 nov 2026 UTC

¿Qué sistemas y versiones están afectados?

Producto	Afectado	Versión corregida / acción
iOS — chain A, observed delivery	Sekoia retrieved the chain with an iOS 16.7 profile. It combines CVE-2025-43529 and CVE-2024-27834 to collect cookies. This is an observed delivery profile, not a complete affected version range.	Install current Apple security updates supported by the exact device. This review does not establish a fixed iOS 16.7.x build; do not assume the newest build offered to an older model contains every required fix.
iOS — chain B, observed delivery	Sekoia retrieved a DarkSword chain with an iOS 18.5 profile: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Its payload can collect messages, credentials and other device data.	Use current Apple security releases for the device. Google's earlier DarkSword analysis reports all of its chain vulnerabilities patched by iOS 26.3; that does not establish one minimum fix for every older iOS branch or for Poisoned Source chain A.
Android — chain C, observed delivery	The delivery selector served Chrome 139–145, excluding 143. The chain combines CVE-2026-3910 in Chrome with CVE-2025-27038 in Adreno GPU drivers; browser version alone does not establish device exposure.	Update Chrome and install the device manufacturer's applicable security update for the GPU driver. Google's March 12 Android release includes the corresponding desktop fix for CVE-2026-3910. Confirm driver coverage with the device vendor; a Chrome update is not a GPU driver update.

Usá las indicaciones para tu producto y rama. Confirmá con el proveedor las correcciones adaptadas a tu distribución; el nombre del producto por sí solo no establece exposición.

¿Qué evidencia respalda este aviso?

Evidencia del incidente

Informe de investigación

Fundamento de la prioridad

Observed exploit delivery warrants reviewing mobile update coverage this week. Delivery depends on device and browser versions; local evidence of compromise requires immediate incident response.

¿Qué implica para los entornos de IA?

Stolen mobile sessions can expose business services, including AI consoles accessible through those accounts. This is an access risk to assess, not evidence that Poisoned Source targeted AI agents.

Fuentes de este aviso

Poisoned Source: mobile delivery, recovered chains and attribution assessmentSekoia · Revisado 4 nov 2026 UTC
Apple security releases and device eligibilityApple · Revisado 4 nov 2026 UTC
DarkSword: earlier research and patch context, separate from Poisoned SourceGoogle Threat Intelligence Group · Revisado 4 nov 2026 UTC
Chrome for Android: March 12 security updateGoogle · Revisado 4 nov 2026 UTC
CVE-2026-3910: corresponding Chrome security fixGoogle · Revisado 4 nov 2026 UTC
CVE-2025-27038: Qualcomm CNA record for Adreno GPU driversQualcomm, via CVE Program · Revisado 4 nov 2026 UTC

Abrir evidencia de respaldo y registro técnico

Historial editorial1 entrada

4 nov 2026 UTCAdded campaign evidence, observed delivery profiles and separate guidance for updates and account recovery.

Acciones de respuesta

Prepará tu respuesta

0 de 4 acciones registradas como completadas

Usá esta lista para evaluar si el aviso afecta a tus sistemas, registrar las acciones de tu equipo y compartir el resultado. Radar no escanea ni verifica tu entorno.

Los cambios se guardan automáticamente en este navegador. No se sincronizan con tu equipo ni se envían a Oktsec.

1. Evaluá si aplica a tu entorno

Revisá los sistemas y versiones afectados y registrá tu decisión a continuación. Si tenés dudas, elegí «Requiere verificación».

Evaluación de aplicabilidadSin evaluar

2. Registrá la respuesta

Indicá el sistema y la persona o equipo responsable. Actualizá cada acción y agregá una referencia al ticket o notas sobre lo revisado.

Sistema o servicioPersona o equipo responsable

Verify the versions actually running
Check OS, Chrome and device security patch levels against vendor guidance for each model. Confirm installation, not just that updates are enabled. If the device cannot receive the necessary fixes, restrict sensitive access and plan a supported replacement. Do not infer safety from the browser version alone.
Estado: Verify the versions actually running
Agregar evidencia o notas
Evidencia o notas de seguimientoUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
Review indications without assuming every visitor was compromised
Compare available browser, DNS, proxy and identity logs with Sekoia's dated indicators. Its documented Plerdy compromise ran from August 27 to September 3, 2026. A visit or indicator match is a reason to investigate, not proof of a successful device compromise. Do not revisit suspected infrastructure to test it.
Estado: Review indications without assuming every visitor was compromised
Agregar evidencia o notas
Evidencia o notas de seguimientoUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
Recover sessions and credentials when evidence warrants it
Oktsec recommends coordinating with identity administrators to revoke affected sessions and tokens, review account activity and rotate exposed credentials from a trusted device. A software update does not revoke cookies or credentials already stolen; a password reset may not end every existing session.
Estado: Recover sessions and credentials when evidence warrants it
Agregar evidencia o notas
Evidencia o notas de seguimientoUsá solo referencias. No guardes credenciales ni datos confidenciales acá.
Escalate credible findings and preserve evidence
Preserve relevant logs and obtain qualified mobile incident response support when findings indicate compromise. Coordinate device containment and account recovery before wiping the device. Keep attribution separate from the operational decision to protect the user and their accounts.
Estado: Escalate credible findings and preserve evidence
Agregar evidencia o notas
Evidencia o notas de seguimientoUsá solo referencias. No guardes credenciales ni datos confidenciales acá.

3. Compartí el plan

Descargá un archivo Markdown con tu decisión, los estados de las acciones, las notas y las fuentes. Compartilo con tu equipo o adjuntalo a un ticket.

VERIFICÁ TU ENTORNO

Sistemas afectados y correcciones

Abrir plan de respuesta

Compará la versión en ejecución y la configuración con las indicaciones del proveedor.

Producto	Afectado	Versión corregida / acción
iOS — chain A, observed delivery	Sekoia retrieved the chain with an iOS 16.7 profile. It combines CVE-2025-43529 and CVE-2024-27834 to collect cookies. This is an observed delivery profile, not a complete affected version range.	Install current Apple security updates supported by the exact device. This review does not establish a fixed iOS 16.7.x build; do not assume the newest build offered to an older model contains every required fix.
iOS — chain B, observed delivery	Sekoia retrieved a DarkSword chain with an iOS 18.5 profile: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Its payload can collect messages, credentials and other device data.	Use current Apple security releases for the device. Google's earlier DarkSword analysis reports all of its chain vulnerabilities patched by iOS 26.3; that does not establish one minimum fix for every older iOS branch or for Poisoned Source chain A.
Android — chain C, observed delivery	The delivery selector served Chrome 139–145, excluding 143. The chain combines CVE-2026-3910 in Chrome with CVE-2025-27038 in Adreno GPU drivers; browser version alone does not establish device exposure.	Update Chrome and install the device manufacturer's applicable security update for the GPU driver. Google's March 12 Android release includes the corresponding desktop fix for CVE-2026-3910. Confirm driver coverage with the device vendor; a Chrome update is not a GPU driver update.

Confirmá con el proveedor las correcciones adaptadas a tu distribución. Coincidir en el producto no basta para establecer exposición.

CoberturaInforme de investigación

EVIDENCIA CON FUENTES

Evidencia y fuentes

Revisado 4 nov 2026 UTC

Por qué tiene esta prioridad

Observed exploit delivery warrants reviewing mobile update coverage this week. Delivery depends on device and browser versions; local evidence of compromise requires immediate incident response.

Criterios de prioridad

Evidencia de CISA KEV

Catálogo 2026.11.03 · Revisado 3 nov 2026 UTC

No hay un CVE coincidente en el corte del catálogo revisado. Esto no demuestra ausencia de explotación. Revisá las fuentes del incidente y las indicaciones del proveedor.