Poisoned Source: APT29-Linked Campaign Turns a Ukrainian Analytics Script Into an iOS and Android Exploit Channel

A suspected APT29 watering hole operation is using compromised websites, fake domains, and a hijacked web analytics service to deliver N-day exploit chains to iPhones and Android phones. Commercial-grade mobile exploit kits are also spreading through criminal ad infrastructure.

What You Need to Know

A Russia-linked actor tracked as APT29 is suspected of running a large-scale campaign that compromises unpatched iOS and Android devices simply by loading a web page. Every infection path ends at the same loader, which fingerprints the device and serves a platform-specific exploit chain that steals cookies, browser data, and Wi-Fi passwords. The same class of tooling is showing up in criminal campaigns spanning hundreds of domains, so the exposure is not limited to APT29’s targets.

What Happened

Sekoia discovered the operation in mid-October 2026 and named it Poisoned Source. It uses three infection vectors: compromised legitimate websites, fake domains, and a supply chain attack on Plerdy SEO Tracker, a Ukrainian web analytics service. Affected sites include a major U.S. chemical industry trade association, a far-right European political party, and a Bulgarian military-related website. At the same time, the supply chain vector also reached army, special forces, and military equipment sites.

All three vectors lead to the same JavaScript loader, which profiles the visitor’s browser and device before serving an N-day exploit chain built for that platform. iOS visitors receive the DarkSword exploit kit, which harvests cookies and full device data. Android visitors receive a payload that steals Chrome data and Wi-Fi passwords without establishing persistence. Sekoia identified at least three Android exploits, and all stolen data goes to ad.starx-net[.]com:8881/telemetry/v12. The Android chain halts if the device is a Samsung Galaxy S25 Ultra (model SM-S938B). The AndroSnitch payload resembles ANDROSNATCH, a Chrome cookie stealer Google documented in August 2024 in a suspected APT29 campaign against a Mongolian government website that used CVE-2024-5274 and CVE-2024-4671.

The Criminal Parallel

Similar tooling is spreading through criminal channels. iVerify and Report URI detailed DarkSword P7 delivered through ad-based infrastructure, including the DeadTag campaign, which buys expired domains that sit behind old analytics and advertising tags and now spans more than 660 domains. Those pages send older iPhones running iOS 13 to 17.2.1 to the Coruna kit and devices on iOS 18.4 to 18.7 to DarkSword P7. Zimperium counted 608 domains serving Coruna-family code as of October 2026. Both kits attack the browser itself, so opening a page on a vulnerable iPhone is enough to be compromised.

Why This Matters

Sekoia could not determine whether the attackers meant to target specific visitors or to compromise as many unpatched mobile devices as possible and sort the stolen data afterward. Either way, the victim list is shaped by who visits the poisoned sites, not by who the attacker chose, which puts anyone browsing defense, industry, or political content on an outdated phone in range. Sekoia also notes that state-sponsored groups keep reusing commercial surveillance vendor frameworks like DarkSword, and that packaged N-day chains lower the cost and skill needed for advanced mobile exploitation. The analytics angle matters too: a single compromised third-party script turns every site that loads it into a delivery point.

What to Do

Update iOS and Android devices to current releases, prioritizing anything on iOS 13 to 17.2.1 or 18.4 to 18.7. Audit the third-party scripts and analytics tags loaded on your own web properties, and remove stale tags pointing at domains you no longer control, since expired domains behind old tags are exactly what DeadTag buys. Because the payloads target cookies, use MFA and session revocation to limit what a stolen session can do. Defenders should also hunt for traffic to the starx-net[.]com infrastructure.

Three No-Interaction Android RCEs Lead Google’s November 2026 Security Update

Google’s November 2026 Android bulletin fixes three critical remote code execution flaws, along with privilege escalation, denial-of-service, and information disclosure issues across Android 14 through 17. Here’s what’s affected and how to confirm devices are actually patched.

What You Need to Know

Google patched three critical remote code execution vulnerabilities in Android 14, 15, 16, 16-QPR2, and 17; the most severe, CVE-2026-58868, requires no user interaction or extra privileges. The fixes are split across two patch levels, and an Android version number does not tell you whether a device has them. The priority is confirming the installed security patch level, not just pushing an update.

What’s Vulnerable

The most severe issue, CVE-2026-58868, sits in the Android Framework and could allow code execution without user interaction or additional execution privileges. Two other critical RCE flaws, CVE-2026-58876 and CVE-2026-58936, affect the System component. The update also fixes critical System privilege escalation and denial-of-service vulnerabilities, plus a high-severity Android Runtime information disclosure flaw, CVE-2026-58988, which likewise requires no user interaction or additional execution privileges.

Google published the bulletin on November 2. The 2026-11-01 patch level covers the listed Framework and System vulnerabilities, while 2026-11-05 includes those fixes and adds applicable kernel and vendor updates. CVE-2026-58876 also appears under Media Codecs in the Google Play system updates section, giving that specific flaw a Project Mainline delivery path.

Why This Matters

These flaws earn priority because exploitation does not depend on talking a user into approving a prompt or taking any other action. Still, the critical rating needs context. The disclosure does not identify the vulnerable interfaces, delivery mechanisms, or a complete attack chain, and “no user interaction” does not mean every affected phone can be compromised directly over the internet. Google’s severity ratings also assume platform and service mitigations are disabled or bypassed. The privilege escalation, denial-of-service, and information disclosure fixes are separate vulnerability classes, not evidence of a documented working exploit chain combining them. The real operational gap is verification: Android updates depend on manufacturers, and fleets routinely report version numbers that say nothing about patch level.

What to Do

Check which manufacturer updates are available for your devices and target security patch level 2026-11-05 or later for full coverage of the applicable November issues, while accurately tracking both the 2026-11-01 and 2026-11-05 levels. Don’t treat the Google Play system update path for CVE-2026-58876 as a substitute for the full manufacturer security update. Use device management reporting to find stale patch levels, confirm installation after deployment, and follow up on devices whose manufacturers have not shipped fixes yet. Platform hardening and Google Play Protect add protection, but neither shows that the vulnerable components have been patched.

Key Eater: Stolen Entra ID App Secrets Open Key Vaults, SharePoint, and MSP Customer Tenants

An ongoing campaign authenticates as legitimate Microsoft Entra ID applications with stolen secrets, then harvests more credentials and sensitive files across Microsoft 365 and Azure. Here’s how the operator moves and what to hunt for.

What You Need to Know

Attackers are using valid, stolen Entra ID application credentials to get into Microsoft 365 and Azure environments, with reported impact across 27 organizations, including managed service providers and their customers. No Microsoft vulnerability is involved, and user-focused controls like Conditional Access do not cover app-only authentication. Organizations that rely on MSP integrations should assume their exposure extends to every tenant those integrations can reach.

What Happened

Todyl tracks the campaign as Key Eater. Victims include MSPs and downstream customers across government, energy, legal, education, and other sectors. Since November 1, 2026, investigators observed attempts against about 45 app registrations across roughly 18 organizations, with successful authentication to more than 33 registrations. They recorded 81 downloaded files and access to approximately 2,279 mailbox items. The attacker authenticated as legitimate applications using valid secrets, and the original theft mechanism and the operator’s identity remain unresolved.

How the Operator Moves

The attack centers on application identities rather than individual user accounts. For nearly every credential, the operator requested an Azure Resource Manager token followed by a Key Vault token, often adding Microsoft Graph, Storage, and Cognitive Services tokens seconds later. Previously unused applications then started authenticating within minutes, which suggests additional secrets were being pulled from Key Vault. The operator ran 29 single-wildcard Microsoft Graph searches across about 25 tenants before downloading SharePoint files at roughly one per second. The haul included password lists, private keys, VPN profiles, backup credentials, firewall configurations, and service-account maps. MSP integrations widened the reach: one multi-tenant application cycled through 15 customer tenants in roughly 10-second loops. The campaign also touched Azure DevOps federated workload identities and stolen sessions. Todyl attributes the activity to an operator directing scripted tooling, not a self-propagating worm.

Why This Matters

The stolen files are a springboard. Password lists, VPN profiles, and firewall configs open doors well beyond Microsoft 365, so the impact can outlast the initial cloud access. The counts above reflect only Todyl’s visibility, and the application-level numbers describe a different scope than the 27-organization victim total, so the true footprint is likely larger. The link between new app activity and Key Vault harvesting is also still a suggestion until Key Vault audit logs confirm the source. Conditional Access blocked every observed user refresh-token replay on November 3, showing user controls worked as designed and aren’t the controls that matter for app-only authentication.

What to Do

Investigate service-principal activity alongside user sign-ins, focusing on unexpected token requests, newly active applications, and cross-tenant access through MSP integrations. Preserve Entra ID, Key Vault, and relevant workload audit logs before disabling compromised applications, then rotate exposed application secrets and any downstream credentials. Extend the investigation to Azure DevOps federated workload identities and stolen sessions. Hunt for the reported operator address 199.19.77.84 and the user agents task177-f2267/1.0 and sait-tenant-deep/37346, keeping in mind the attacker later switched to spoofed browser signatures. MSPs should scope every customer tenant reachable through an affected integration rather than treating each stolen credential as an isolated incident.

Operation CloudFire: Google Calendar Phishing Relays MFA in Real Time to Hijack Live Sessions

A phishing operation active since August 2026 has been stealing live Google sessions from corporate users through calendar invites and a reverse proxy that relays every MFA method in real time. Researchers also took the fight to the operator’s infrastructure.

What You Need to Know

Attackers use Google Calendar invites, often from senders the target already knows, to route corporate users through Google’s redirects into a reverse proxy in front of the real Google sign-in page. The Nyasher framework behind it relays passwords and MFA in real time, so code-based and push MFA does not stop the session from being captured. The result is a hijacked session with access to mail, Drive, and the ability to grant OAuth access in the victim’s name.

What Happened

Material Security detailed the operation, which has harvested live Google sessions from corporate users since mid-August 2026. Lures use mundane pretexts such as voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices, and often arrive from compromised senders the recipient has already corresponded with. Most links route through Google’s own /url redirector, though some waves used share.google, Drive file links, or Intuit transaction notices. Each hop passes a Cloudflare Turnstile challenge before reaching the reverse proxy. Nyasher relays passwords, SMS codes, authenticator codes, number matching, and phone-based recovery to Google in real time. The final capture page is built in the browser by JavaScript, leaving crawlers and proxy logs with nothing to scan.

The Takedown Effort

Material’s researchers launched Operation CloudFire in late September after concluding that detection tuning alone did nothing to the operator preparing the next wave. They reported gateway and backend URLs to Cloudflare, whose abuse team validated them and applied its phishing interstitial, forcing the operator to re-register, re-point, and re-certify infrastructure. Over one month, and only for customers who share data, Material recorded 68,676 blocked messages, 2,112 unique malicious URLs, 897 domains taken down, and 8,570 compromised sender addresses across 6,354 root domains. Sending followed US business hours, and lure domains were disposable: one wildcard certificate was issued 46 minutes before its domain was registered. Themes have since shifted toward Google Drive share invites, and activity appears dispersed.

Why This Matters

The disruption has not ended the threat. Nyasher has been public since February, and the operator left an unfinished Microsoft 365 branch that could be activated by dropping in a file. Material expects the next pivot to look like this one under a different brand. Calendar invites are a gap for most organizations because gateways built for mail in transit handle them poorly, and a first hop on a Google URL defeats domain reputation checks. Because the outcome is a hijacked session rather than a stolen password, the evidence lives in Workspace audit logs, not in password reset tickets. One caveat on the numbers: the source is sponsored content written by Material Security, so the detection and volume figures reflect the vendor’s own visibility.

What to Do

Treat calendar invites as a threat surface, and don’t rely on domain reputation when the first hop is a Google URL. Review Workspace audit logs for anomalous sign-ins and new OAuth grants. Confirm your team can revoke sessions, contain OAuth grants, and reset an affected account within an hour. Move toward phishing-resistant MFA such as passkeys or security keys, which resist real-time relay far better than codes or push approvals.

Gorbag Uses Patched WinRAR Flaw CVE-2025-8088 to Drop BeautyStealer on Ukrainian Justice, Government, and Defense Targets

A Russia-aligned actor is exploiting a year-old WinRAR path traversal flaw to steal credentials, VPN material, and electronic-signature keys from Ukrainian organizations. Here’s how the campaign evolved and how to investigate it.

What You Need to Know

Russia-aligned threat actor Gorbag is exploiting CVE-2025-8088 in WinRAR to deploy BeautyStealer against Ukrainian law enforcement, justice, local government, and defense organizations. The flaw was patched in July 2025, so every successful infection is landing on an outdated WinRAR install. The campaign is built for fast data theft, so cleanup must include the credentials and keys taken, not just the malware.

What Happened

ESET presented the research at Virus Bulletin 2026, describing a campaign active since at least February 2025. About one quarter of identified targets belong to Ukraine’s justice and law enforcement sectors, and another quarter are local governments. Other targets include a transportation hub supporting foreign military aid.

Gorbag first distributed macro-enabled Excel attachments using administrative fines, tax matters, and military notices as lures, sometimes sent through compromised Ukrainian government accounts. VBA routines decoded payloads stored in spreadsheet cells, wrote BeautyStealer into %ProgramData%, and launched it. In early 2026, the operators switched to malicious RAR attachments exploiting CVE-2025-8088, a path traversal flaw that abuses alternate data streams to extract files outside the selected destination. A decoy PDF accompanies an encrypted payload, and a PowerShell loader is dropped under %ProgramData%, while a malicious shortcut lands in the Windows Startup folder. At the next user logon, the shortcut invokes PowerShell to load the next stage. ESET originally discovered the flaw during RomCom attacks in July 2025, and WinRAR 7.13 fixed it on July 30, 2025. Windows versions through 7.12 are affected.

What BeautyStealer Takes

BeautyStealer collects browser cookies, saved passwords, and profile data from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations and selected documents. Collection reaches removable media and mapped network drives, targeting KeePass databases, Java keystores, VPN configurations, and Ukrainian electronic-signature keys with the .zs2 extension. Compressed data leaves through Telegram’s sendDocument API or attacker-controlled HTTPS infrastructure running FastAPI.

Why This Matters

ESET assesses that the target selection could support monitoring of investigations, local defense preparations, and damage from Russian strikes. The operation favors compact collection tools over long-term remote control, so the central concern is what was stolen rather than a lingering backdoor. That shifts the investigative focus: a clean endpoint after removal says nothing about whether the attacker still holds working sessions, VPN access, or signing keys. And because this is a patched N-day, not a zero-day, the exposure comes down to whether WinRAR is actually up to date across the fleet, which is easy to miss for a utility that rarely gets inventoried.

What to Do

Verify WinRAR versions across endpoints and upgrade anything at 7.12 or earlier to a supported release containing the fix. In investigations, correlate suspicious archive extraction with new Startup shortcuts, PowerShell execution, and payloads under %ProgramData%, then review outbound transfers to Telegram and unfamiliar HTTPS destinations. If BeautyStealer ran, treat malware removal as one containment step: assess exposed sessions, credentials, VPN material, and signing keys, then revoke or replace affected access material based on scope.