"The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and Félix Aime wrote — and then, according to their report, the infrastructure behind what they call the Poisoned Source operation decides how to exploit the visitor's device.
Supply chain compromise of Plerdy SEO Tracker (Aug 27–Sep 3, 2026)
Sekoia says the operation included a supply-chain insertion into the Ukrainian web analytics service Plerdy SEO Tracker. Between August 27 and September 3, 2026, malicious code was injected into the file at "a.plerdy[.]com/public/js/click/main.js", allowing numerous sites that loaded the script to propagate attacker-controlled JavaScript.
The company discovered the broader campaign in mid-October 2026 and gave it the codename Poisoned Source. The injected loader profiles visitors, then routes them into platform-specific exploitation chains for iOS or Android.
Three exploit classes, enumerated CVEs, and a single telemetry sink
Sekoia identified three distinct exploit classes. Class A targets iOS 16.7 and chains CVE-2025-43529 and CVE-2024-27834 to deliver JavaScript malware for cookie theft. Class B targets iOS 18.5, using a DarkSword exploit chain — CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520 — to exfiltrate comprehensive device data, including SMS/iMessage content, multiple Apple Mail/Protected Index SQLite databases, voicemail, WhatsApp and Telegram databases, iCloud Keychain and Wi‑Fi passwords, contacts, call history, Safari history and cookies, photos, and Apple Health, Calendar, Notes and iCloud Drive content. Class C targets Android devices running Chrome 139–145 (explicitly excluding version 143) and leverages CVE-2026-3910 and CVE-2025-27038 to achieve remote code execution and deliver a payload called AndroSnitch.
In all three cases, exfiltrated data is sent to the same endpoint: "ad.starx-net[.]com:8881/telemetry/v12".
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDarkSword, Coruna, DeadTag and the evolution of exploit delivery
Sekoia places Poisoned Source in a landscape of evolving mobile exploit kits. The report cites DarkSword as the kit used against modern iOS targets and notes recent reporting by iVerify and Report URI on a DarkSword P7 variant delivered via ad-driven "half-click" attacks. Report URI also described a separate criminal scheme, DeadTag, in which expired analytics and advertising domains are re-registered and used to deliver browser-based exploits silently to iPhone visitors.
Report URI's analysis indicates that DeadTag checks incoming visitors and serves exploit code only to likely human targets, avoiding search engines and security scanners. Zimperium zLabs found 608 domains delivering Coruna-family code as of October 2026; Report URI said DeadTag includes more than 660 expired and re-registered domains overall. Coruna targets older iPhones (iOS 13–17.2.1) while DarkSword P7 targets later builds (iOS 18.4–18.7), and both operate by exploiting the browser — no user click or download required.
Targets observed and infection vectors: watering holes, lookalikes, and ads
Sekoia describes three infection vectors: direct compromise of legitimate websites to inject malicious JavaScript; lookalike domains impersonating high-profile sites (for example, "america250[.]holiday"); and the Plerdy supply-chain compromise. Some compromised sites include a major U.S. chemical-industry trade association, a far-right European political party, and a Bulgarian military-related website. Sekoia notes these sites are likely to attract “high-value or strategically important visitors in the context of the Russia-Ukraine war,” while also acknowledging it is unclear whether operators aimed at specific visitors or the broad pool of unpatched mobile devices.
What this means for technologists, policymakers, and end users
- Technologists and security teams: Expect supply-chain contamination of widely distributed analytics scripts to be a high-risk vector; detection should include monitoring for unexpected changes to third-party JavaScript and telemetry sinks like "ad.starx-net[.]com:8881/telemetry/v12".
- Policymakers and regulators: The campaign underscores how commercial surveillance vendor exploit frameworks and re-registered analytics domains can amplify state-linked operations, highlighting points where oversight, disclosure standards, or incident response coordination could focus.
- End users and enterprise device owners: The attack chains profiled by Sekoia require only that a vulnerable browser or OS be opened; the report stresses there is no click or install in many cases, and that modern exploit kits can harvest extensive personal and corporate data.
The Poisoned Source findings stitch together three familiar threads — supply-chain insertion, lookalike domains and ad-driven malvertising — and link them to a single program of mobile exploitation. The report documents ready-made N-day chains being reused to lower the technical cost of mobile compromise, and it leaves one concrete operational question open: whether this campaign aimed at specific, high-value visitors or sought broad compromise of any vulnerable devices that wandered into the trap. Either answer points to sustained risk for users and organizations that load third-party JavaScript from external analytics or ad infrastructure.
