What Is the APT29 Mobile Watering Hole Campaign? (And Why It Matters for Enterprises)
The "Poisoned Source" campaign is a large-scale watering hole operation, attributed with moderate to high confidence to the Russia-linked group APT29, that infects visitors' iPhones and Android phones simply because they opened a web page. French firm Sekoia discovered it in mid-October 2026. On November 4, 2026, CISA added one of the Apple flaws used in it, CVE-2024-27834, to its Known Exploited Vulnerabilities (KEV) catalog.
A watering hole attack plants malicious code on websites that the target audience already visits, instead of sending the target a phishing email. Here the attackers used three routes: legitimate sites that were compromised, lookalike domains imitating well-known sites, and a supply chain attack on the Plerdy SEO Tracker analytics script, which was altered between August 27 and September 3, 2026. A single script that many sites trust became a delivery system.
Why should a CIO care about a campaign that appears aimed at specific high-value visitors? Because the tools matter more than the targets. Sekoia notes that packaged exploit kits such as DarkSword lower the cost and skill needed for advanced mobile attacks, and researchers report that the related Coruna kit leaked and is now used by several actors. Techniques that start in espionage rarely stay there. Executives, finance staff and field teams all browse on phones that hold corporate email, chat and single sign-on sessions, so a compromised phone is a compromised identity. This is precisely the exposure a mature cybersecurity program has to cover.
