A large-scale watering-hole campaign associated with Russia-linked APT29 targeted iOS and Android users through compromised websites, lookalike domains and a modified web analytics script. Sekoia researchers found that JavaScript profiled visitors’ devices and browser versions before a command-and-control server selected a platform-specific exploit chain without user interaction. The attacks could extract cookies, messaging-app databases, credentials and other device data, depending on the targeted operating system and browser. The campaign also involved a compromise of Ukrainian analytics service Plerdy, whose tracker was loaded by thousands of websites mostly in Ukraine from August 27 to September 3. Apple and Google have patched the targeted flaws, and users are advised to install the latest available security updates.
Why it matters
The campaign shows how visiting a compromised or impersonated website can expose unpatched mobile devices without requiring a user click. Developers and security teams should account for third-party scripts, browser versions and mobile patch levels when assessing web and application risk.
Key points
- Sekoia attributed the campaign to APT29, also known as Midnight Blizzard, with moderate-to-high confidence.
- The modified Plerdy SEO Tracker reached thousands of websites, mostly in Ukraine, from August 27 to September 3.
- The campaign targeted iOS 16.7, iOS 18.5 and Chrome for Android versions 139 to 145, excluding 143.
- Payloads could collect cookies, messaging databases, credentials, location data, photos and saved Wi-Fi credentials.
- The payloads did not establish persistence; rebooting stopped activity until the device revisited a compromised site.
Based on reporting by BleepingComputer and The Hacker News.
RinkiPosted Nov 5, 2026, 6:12 AM EST
🚀