A one-week tampering job on an obscure analytics file put working iPhone exploit code in front of anyone loading a Ukrainian military or news page this summer. No zero-day was needed.
Three doors, one payload
Sekoia, the French research shop, calls the operation Poisoned Source. It tracked three routes into one loader: JavaScript spliced into real site templates, lookalike domains that relayed genuine pages while editing them in transit, and a supply chain break at Plerdy, a Ukrainian SEO tracker embedded on thousands of mostly domestic sites.
That compromise ran from August 27 to September 3. Visitors to army recruitment, special forces and drone-supply pages picked up the attackers’ code alongside the legitimate analytics tag. Fake domains copying America250 and Raffles London at The OWO, a hotel steps from the UK Ministry of Defence, hint that some targets were picked by name.
Fingerprinting at industrial scale
The profiler Sekoia calls UltimateFingerprinter hides inside a 2.3 MB AngularJS bundle, real code filling roughly two percent of the file. It runs 61 collectors and builds 394 fields before a delivery server picks a chain. Only an implausible screen size sends a visitor away.
Three packages came off that infrastructure. Class A, aimed at iOS 16.7, chains CVE-2025-43529 with CVE-2024-27834 to lift Safari cookies. Class B targets iOS 18.5 through the leaked DarkSword kit, joining CVE-2026-20700 to four companions and stripping Messages, Keychain, Wi-Fi keys and photos.
What it tells defenders
Nothing persisted, so a reboot ends the session, pointing to intelligence collection rather than durable access. Every flaw carried a patch before the operation opened, and Sekoia rates the APT29 link at moderate to high confidence.
The exposure sits with hardware frozen on old firmware. iOS 16 and 18.5 builds still in service cannot be repaired by anything Apple ships today.
