By the Smili Phone team
Security researchers at Sekoia published findings on November 4, 2026, about a campaign they call Poisoned Source, a reminder that the most dangerous thing on a phone is often the update you keep putting off. The campaign is tied to APT29, the Russia-linked group also known as Cozy Bear, and it goes after iPhones and Android phones that have not been updated. Every bug in the attack already has a fix. The campaign works because so many phones never get it.
How the attack works
The attackers did not send a suspicious text or a strange attachment. They compromised ordinary websites, built lookalike pages, and tampered with a copy of a web analytics script called the Plerdy SEO Tracker between August 27 and September 3. When someone visited one of those pages on a phone, a small script checked the device and browser, then served an exploit chain matched to that phone. Nothing on the page looked wrong. The visitor did not have to click anything or download anything. Visiting the page was enough.
What the attackers can take
The payload depends on how old the phone software is. On iPhones running iOS 16.7, one chain used a WebKit bug tracked as CVE-2024-27834 to steal browser cookies. On phones running iOS 18.5, a heavier chain called DarkSword pulls nearly everything off the device: messages, mail, WhatsApp and Telegram data, Keychain passwords, and photos. Android phones running Chrome 139 through 145 got a separate chain that steals Chrome data and saved Wi-Fi passwords. The pattern is the same in every case. The older the software, the more the attackers can reach.
The fix is already out
Apple fixed CVE-2024-27834 back in May 2024, in iOS 17.5 and iOS 16.7.8, and the fixes for the other bugs in these chains are out too. On November 4, the US cybersecurity agency CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities list, so federal agencies must patch by November 18. For everyone else, the fix is the same and it is free: install the newest software your phone can run. A phone that is fully updated is not vulnerable to these specific chains.
Check your phone in two minutes
On an iPhone or iPad, open Settings, then General, then Software Update, and install whatever is waiting. On Android, update Chrome from the Play Store, then check Settings for a system update and confirm the security patch level is recent. If your iPhone is too old to run a current version of iOS, retire it from anything that touches work email, banking, or company accounts. People who might be targets, such as staff who work with government or defense customers, should also turn on Lockdown Mode, which tightens the browser and messaging apps against this kind of attack.
Attackers love old software because it never fights back. A phone that sat on the same iOS version for two years is an open door, and the people walking through it are organized and patient. The defense costs nothing and takes two minutes. Update the phone, update the browser, and the door closes. If your phone will not update, or you are not sure whether it is current, bring it by our shop in Escondido and we will check it in person and help you get it protected.
Related: Your phone has a hidden security mode worth turning on · The Android SMS of Death and the hidden text that kills calls
