Mobile Watering Holes, Refrigerator Botnets, and 7.3 Billion Phishing Threats

Nation-state actors are running mobile exploitation infrastructure with confirmed UK targeting. Commercial refrigeration controllers in supermarkets and cold storage facilities have been compromised and conscripted into spam botnets. Microsoft’s Q3 2026 email threat report documents 7.3 billion phishing attempts in a single quarter, with attackers shifting to SVG attachments and CAPTCHA-gated techniques that bypass most email filters. Meanwhile, DigiCert has disclosed a sixteen-month security lapse affecting one of the world’s largest certificate authorities. All four stories share a common thread: internet-facing systems with known vulnerabilities that remain unpatched and unmonitored. This episode examines APT29’s Poisoned Source campaign, which uses compromised analytics providers and watering hole attacks to deliver mobile exploits targeting unpatched iOS and Android devices. We analyse the operational reality of industrial control systems being weaponised for spam infrastructure, and explain why SVG attachments now represent a significant email security gap. The practical message is straightforward: the attackers are not finding clever new ways in, they are walking through doors that have been left open.

Chapters

• Introduction Overview of three active, confirmed threats: nation-state mobile exploitation with UK targeting, commercial refrigerators conscripted into spam botnets, and Microsoft’s Q3 2026 email threat data showing 7.3 billion phishing attempts.
• APT29 Mobile Watering Holes and UK Targeting Detailed analysis of APT29’s Poisoned Source campaign, including supply chain compromise of Ukrainian analytics provider Plerdy, mobile-specific exploit chains targeting iOS and Android n-day vulnerabilities, and confirmed impersonation of a luxury UK hotel website near sensitive government institutions. Examination of watering hole operational mechanics and the risk to UK businesses from unpatched mobile devices accessing compromised sites.
• Call to Action Encouragement to follow the show and share with others who need threat intelligence.
• Refrigeration Controllers as Spam Infrastructure Analysis of SecurityScorecard research documenting Dixell and Copeland XWEB PRO refrigeration controllers being exploited to route spam. Examination of why industrial control systems represent entry points rather than targets, and the broader pattern of IoT and embedded devices being conscripted into proxy botnets.
• Microsoft Q3 2026 Email Threat Landscape Review of Microsoft’s Q3 2026 email threat report documenting 7.3 billion phishing threats, the shift from QR code attacks to SVG attachments with embedded JavaScript, CAPTCHA-gated phishing techniques, Microsoft Teams social engineering, and the XLoader malware campaign using obfuscated JScript files in RAR archives.
• DigiCert Sixteen-Month Breach Disclosure Brief coverage of DigiCert’s disclosure of a sixteen-month security lapse following a botched server migration, and the implications for businesses using certificates from major providers.
• Conclusion Summary of the common thread across all stories: internet-facing systems with known vulnerabilities that remain unpatched and unmonitored. Practical recommendations for mobile device management, operational technology security review, email gateway configuration, and provider contract terms.

Links

• https://www.sekoia.io/en/poisoned-source-apt29s-multi-vector-watering-hole-campaign/
• https://arstechnica.com/security/2024/11/russian-spies-jumped-from-one-network-to-another-via-wifi/
• https://securityscorecard.com/research/refrigerator-botnet-exposed
• https://www.ncsc.gov.uk/collection/industrial-control-system-security
• https://www.microsoft.com/en-us/security/blog/2024/11/05/email-threat-landscape-report-q3-2024/
• https://www.digicert.com/support/certificate-breach-notification