Science & Tech · Cybersecurity · 1 hr ago
APT29 campaign targeted iPhones and Android devices through compromised websites
Researchers at cybersecurity company Sekoia linked a mobile cyberespionage campaign to Russia's APT29 group, also known as Midnight Blizzard and Cozy Bear.
It targeted iPhone and Android users who visited compromised or lookalike websites, including sites connected to Ukraine, the United States, the Czech Republic and Bulgaria.
Attackers also compromised Plerdy, a Ukrainian web analytics service, for a week, exposing visitors to many sites that used its tracker.
The sites used code to identify visitors' devices and browsers, then deliver an attack without requiring a click or other action.
The attacks could steal cookies, device information and Wi-Fi passwords, with some iPhone attacks also targeting messaging data and credentials.
The campaign used flaws that Apple and Google had already patched, so up-to-date devices are protected from these attack chains.
Users should install the latest available security updates; researchers said they did not know how many devices were compromised.
A cyberespionage campaign attributed with moderate-to-high confidence to Russia-linked group APT29 targeted visitors to websites using exploits against iPhones and Android devices.
The campaign used scripts injected into legitimate sites, lookalike domains and a week-long compromise of Ukrainian analytics service Plerdy.
Its payloads could steal cookies, device data and Wi-Fi passwords without user interaction.
The exploits targeted flaws that had already been patched by Apple and Google.
Researchers said users with up-to-date operating systems were protected from these specific attacks.
- Who
- APT29, also known as Midnight Blizzard and Cozy Bear, or one of its subgroups, according to Sekoia.
- What
- A cyberespionage campaign used website-based attacks and exploit chains to collect data from mobile devices.
- When
- Sekoia uncovered the activity in October 2026; it published its research on November 4.
- Where
- Visitors to legitimate and lookalike websites, including sites connected to Ukraine, the United States, the Czech Republic and Bulgaria, were exposed.
- Why
- Not stated
This story does not have two clearly opposing sides.
Plerdy was compromised, exposing hundreds of websites and their visitors to the exploit kit.
Sekoia uncovered the campaign.
Sekoia published its research on the activity.
- Attribution
- APT29, also known as Midnight Blizzard and Cozy Bear
- Delivery routes
- Injected scripts, lookalike domains and a compromised Plerdy tracker
- Plerdy compromise
- August 27 to September 3
- Targeted platforms
- iOS and Android devices
- Data sought
- Cookies, device data and Wi-Fi passwords
5 sources
Russian state-backed hackers launch mobile cyberespionage campaign
Hackers exploited iOS and Android flaws to infect phones
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29 Watering Holes Target Unpatched iPhones and Android Devices
Hackers use n-day exploits in zero-click attacks on iOS, Android devices
What people are saying
a user running an up-to-date operating system is safe from these attacks