CVE-2025-43529Class A/B WebKit entry
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
Poisoned Source mobile exploit campaign uses compromised sites, lookalikes and Plerdy analytics
Sekoia reports Poisoned Source delivering patched iOS/Android exploits through websites, lookalikes and Plerdy’s August–September script compromise. It assesses an APT29 link with moderate-to-high confidence. Plerdy confirms server/contact-data access but no known visitor compromise; infection totals are unknown.
- Disclosed
- Nov 4, 2026
- Updated Nov 6, 2026
- Severity
- Septic Tank Blew
- 8 CVEs tracked here
- Splash zone
- Unpatched mobile visitors to campaign pages or sites loading poisoned Plerdy code August 27–September 3; exposure is not proof of infection.
- Plerdy · Mobile · Supply chain
- In the wild
- Yes
- Sekoia documents deployed exploit delivery; no confirmed visitor-infection total is given.
What happened
The November 4 disclosure covers the wider campaign; Plerdy’s earlier component notice is not a new November intrusion. Its script was one vector alongside direct injections and lookalike reverse proxies. Sekoia inferred the Plerdy fingerprinting link from matching filenames and redirects because that host was offline; Plerdy says no visitor compromise is known. Hundreds/thousands of tracker-loading sites are exposure estimates, not infected-device counts. Attribution remains Sekoia’s assessment. No final victim total or confirmed card theft is established. L4 reflects documented operational exploit delivery; a fully updated device is outside the recovered n-day chains, not immune to every attack.
What’s in the bowl
Class A pointer-authentication bypass
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2026-20700Class B pointer-authentication bypass
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2025-14174Class B first sandbox-escape step
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2025-43510Class B second sandbox-escape step
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2025-43520Class B kernel privilege escalation
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2026-3910Class C Chrome entry
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
CVE-2025-27038Class C Android escalation
Known, previously patched flaw used in a recovered mobile exploit chain; not a newly disclosed zero-day.
Crime-scene timeline
Aug 27, 2026
Plerdy’s script-compromise window begins
Sep 3, 2026
Plerdy removes unauthorized tracking code
The vendor says server credentials were replaced; passwords and all sessions were reset/ended September 4.
Nov 4, 2026
Sekoia publishes the wider Poisoned Source campaign
The report links three delivery vectors and recovered iOS/Android chains; attribution is a moderate-to-high-confidence assessment, not proof every visitor was infected.
Nov 6, 2026
Plerdy updates its public response
It confirms stolen administrator credentials, customer contact-data access and prior resets, says no visitor compromise is known, and offers technical indicators to customers.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Sekoia original Poisoned Source investigationPrimaryNovember 4 wider campaign report: three vectors, eight used CVEs, observed profiles, all public network/13 hash indicators and attribution confidence; some infrastructure is withheld.
- Plerdy original incident response, updated November 6PrimaryConfirms August–September server/script compromise, client contacts, September 4 password/session reset, no known visitor compromise, verified current build and technical-report availability.