# Poisoned Source: mobile exploits target cookies and private data Canonical: https://www.oktsec.com/radar/poisoned-source-mobile-campaign Publisher: Oktsec Language: en Published: 2026-11-04T18:36:14Z Updated: 2026-11-04T18:36:14Z Record reviewed: 2026-11-04T18:36:14Z Latest evidence check: 2026-11-04T18:36:14Z Disclosed: 2026-11-04 Sekoia recovered three mobile exploit chains delivered through compromised or impersonated websites, with payloads capable of stealing cookies and private data. The report attributes Poisoned Source to APT29 with moderate to high confidence; it does not establish a count of compromised phones. ## Evidence and response priority - Category: Threat activity - Oktsec priority: Review this week - Rationale: Observed exploit delivery warrants reviewing mobile update coverage this week. Delivery depends on device and browser versions; local evidence of compromise requires immediate incident response. - Evidence: Research report - Verification: Single source - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Target sector: Mobile users visiting compromised or impersonated websites - Products: Apple iOS, Google Chrome for Android, Qualcomm Adreno GPU drivers - CVEs: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038 ## Research findings Poisoned Source reaches mobile browsers through legitimate websites modified by attackers, impersonated sites and a reported compromise of the Plerdy analytics service. Sekoia discovered the activity in October 2026 and recovered three complete exploitation chains with their final payloads. These observations establish delivery and capabilities, not how many phones were successfully compromised. The recovered chains target specific profiles: iOS 16.7, iOS 18.5 and selected Chrome versions on Android. Capabilities range from cookie theft to collection of messages, credentials and other private data. Android exploitation also depends on an Adreno GPU driver vulnerability. The delivery profiles below are not a universal affected product matrix. Sekoia says the analyzed chains use vulnerabilities patched before this campaign and do not work against fully updated devices. This does not establish a safe build for every legacy model. Verify the fixes available for the exact device and restrict sensitive access where necessary updates are unavailable. Attribution to APT29, or a subgroup, is Sekoia's assessment with moderate to high confidence. Vendor patch notices and Google's earlier DarkSword research provide technical context; they do not independently confirm this campaign's attribution or victim count. Website exposure should not be presented as a count of infected phones. For organizations, patch coverage and account recovery are separate tasks. Oktsec recommends reviewing update coverage this week and responding immediately to credible local evidence. Where sessions or credentials may have been stolen, coordinate revocation and recovery from a trusted device; patching alone does not restore account control. ## Recommended response Verify OS, browser and device security updates. If evidence indicates compromise, preserve logs and coordinate session revocation and credential recovery from a trusted device; installing updates alone does not invalidate stolen sessions. Relevant to: Teams responsible for mobile devices and identity security, especially users with sensitive access who may have visited the websites or infrastructure documented by Sekoia. ## Affected systems and fixes ### iOS — chain A, observed delivery Affected: Sekoia retrieved the chain with an iOS 16.7 profile. It combines CVE-2025-43529 and CVE-2024-27834 to collect cookies. This is an observed delivery profile, not a complete affected version range. Fixed release / action: Install current Apple security updates supported by the exact device. This review does not establish a fixed iOS 16.7.x build; do not assume the newest build offered to an older model contains every required fix. ### iOS — chain B, observed delivery Affected: Sekoia retrieved a DarkSword chain with an iOS 18.5 profile: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. Its payload can collect messages, credentials and other device data. Fixed release / action: Use current Apple security releases for the device. Google's earlier DarkSword analysis reports all of its chain vulnerabilities patched by iOS 26.3; that does not establish one minimum fix for every older iOS branch or for Poisoned Source chain A. ### Android — chain C, observed delivery Affected: The delivery selector served Chrome 139–145, excluding 143. The chain combines CVE-2026-3910 in Chrome with CVE-2025-27038 in Adreno GPU drivers; browser version alone does not establish device exposure. Fixed release / action: Update Chrome and install the device manufacturer's applicable security update for the GPU driver. Google's March 12 Android release includes the corresponding desktop fix for CVE-2026-3910. Confirm driver coverage with the device vendor; a Chrome update is not a GPU driver update. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.03 Checked: 2026-11-03T22:13:58Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z. ## Response checklist 1. **Verify the versions actually running** — Check OS, Chrome and device security patch levels against vendor guidance for each model. Confirm installation, not just that updates are enabled. If the device cannot receive the necessary fixes, restrict sensitive access and plan a supported replacement. Do not infer safety from the browser version alone. 2. **Review indications without assuming every visitor was compromised** — Compare available browser, DNS, proxy and identity logs with Sekoia's dated indicators. Its documented Plerdy compromise ran from August 27 to September 3, 2026. A visit or indicator match is a reason to investigate, not proof of a successful device compromise. Do not revisit suspected infrastructure to test it. 3. **Recover sessions and credentials when evidence warrants it** — Oktsec recommends coordinating with identity administrators to revoke affected sessions and tokens, review account activity and rotate exposed credentials from a trusted device. A software update does not revoke cookies or credentials already stolen; a password reset may not end every existing session. 4. **Escalate credible findings and preserve evidence** — Preserve relevant logs and obtain qualified mobile incident response support when findings indicate compromise. Coordinate device containment and account recovery before wiping the device. Keep attribution separate from the operational decision to protect the user and their accounts. ## Relevance to AI environments Stolen mobile sessions can expose business services, including AI consoles accessible through those accounts. This is an access risk to assess, not evidence that Poisoned Source targeted AI agents. ## Sources - [Poisoned Source: mobile delivery, recovered chains and attribution assessment](https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits) — Sekoia; Research report; checked 2026-11-04T18:36:14Z - [Apple security releases and device eligibility](https://support.apple.com/en-us/100100) — Apple; Vendor notice; checked 2026-11-04T18:36:14Z - [DarkSword: earlier research and patch context, separate from Poisoned Source](https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain) — Google Threat Intelligence Group; Research report; checked 2026-11-04T18:36:14Z - [Chrome for Android: March 12 security update](https://chromereleases.googleblog.com/2026/03/chrome-for-android-update_12.html) — Google; Vendor notice; checked 2026-11-04T18:36:14Z - [CVE-2026-3910: corresponding Chrome security fix](https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html) — Google; Vendor notice; checked 2026-11-04T18:36:14Z - [CVE-2025-27038: Qualcomm CNA record for Adreno GPU drivers](https://www.cve.org/CVERecord?id=CVE-2025-27038) — Qualcomm, via CVE Program; Vendor notice; checked 2026-11-04T18:36:14Z ## Editorial record - 2026-11-04T18:36:14Z: Added campaign evidence, observed delivery profiles and separate guidance for updates and account recovery. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/poisoned-source-mobile-campaign) · [Build a response plan](https://www.oktsec.com/radar/poisoned-source-mobile-campaign#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=poisoned-source-mobile-campaign&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=poisoned-source-mobile-campaign&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.