All incidents

French security firm Sekoia describes a watering-hole campaign it calls Poisoned Source. Attackers injected code into legitimate websites, set up look-alike domains such as a fake America250 site, and compromised the Ukrainian web analytics script Plerdy SEO Tracker between August 27 and September 3, 2026. A loader profiles each visitor and serves an exploit for the device. Older iPhones on iOS 16 lose browser and app cookies, iPhones on iOS 18.5 are hit with the DarkSword toolkit, which takes messages, contacts, photos, location history and data from apps such as WhatsApp and Telegram, and Android phones running older Chrome lose browsing data, cookies and saved Wi-Fi passwords. In some cases no click or download is needed. All three routes use flaws that Apple and Google had already fixed, so fully updated phones are not affected, and the attackers did not keep long-term access. Sekoia found the campaign in mid-October, first on a Ukrainian gas production company's site, and says visitors included a US chemical industry trade association, a far-right European political party and sites aimed at Ukrainian and Bulgarian military audiences. Sekoia presumes the Russia-linked group APT29 is behind it. That is Sekoia's assessment, and it says it is unclear whether specific people were targeted or data was collected broadly.