A cyberespionage campaign linked to Russia’s APT29 hacking group used compromised websites and a hijacked analytics script to target iPhone and Android users.
Visiting an affected page was enough to trigger an attack on a vulnerable device, potentially exposing browser sessions, saved Wi-Fi passwords, and private messages.
Sekoia’s researchers uncovered the campaign in mid-October 2026 after finding malicious JavaScript in the website template of a Ukrainian gas producer. The researchers attributed the operation to APT29, also known as Midnight Blizzard and widely linked to Russia’s Foreign Intelligence Service, with moderate to high confidence.
The attackers also compromised websites belonging to a US chemical industry trade association, a Czech political movement, and a Bulgarian military-related organization. On some sites, they inserted their code into existing JavaScript files. They also set up lookalike domains for the official America250 website and the Raffles London at The OWO hotel, relaying content from the real sites while adding malicious code.
Between August 27 and September 3, the attackers modified the SEO tracker distributed by Plerdy, a Ukrainian web analytics provider whose script is used by thousands of predominantly Ukrainian websites. Sites using the tracker included ones tied to military recruitment and suppliers of drones and ballistic equipment. Sekoia reported that the compromise exposed hundreds of legitimate sites and their visitors to the exploit kit.
All three delivery methods loaded a script Sekoia calls UltimateFingerprinter. It collected hundreds of details about the browser and device, but exploit delivery largely depended on the operating system and browser version, along with basic checks that the visitor appeared to be using a touchscreen device.
From stolen sessions to private messages
Sekoia recovered three exploit chains. One targeted devices running iOS 16.7, targeted browser cookies and could also collect cookies from some running apps. Another targeted devices running iOS 18.5, used the DarkSword exploit kit to gain deeper access, and collected iMessages, WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
On Android, the attackers chained a Chrome vulnerability (CVE-2026-3910) with an Adreno graphics driver flaw (CVE-2025-27038) to deploy a payload named AndroSnitch. It gathered Chrome cookies, login data, and browsing history, along with saved Wi-Fi passwords.
Stolen session cookies allow an attacker to reuse an existing login to access services such as webmail. Sekoia found that the payloads did not establish persistence and is working with national incident response teams to identify victims and assess ways to disrupt the campaign’s infrastructure.
The researchers cited similarities to watering-hole attacks Google documented in 2024 that targeted visitors to Mongolian government websites, as well as traces on one compromised site that a partner linked to a separate 2025 APT29 campaign.
Patches were already available for every flaw used in the three chains. iPhone users should install the latest iOS update available for their device. Android users should update both Chrome and their phone’s OS.
Leave a Reply