Russian-linked hackers targeted vulnerable iPhones and Android devices through legitimate websites in an espionage campaign uncovered by security researchers.
In a November 4 report, cybersecurity firm Sekoia linked the operation with moderate-to-high confidence to APT29, a hacking group associated with Russia's foreign intelligence service.
The investigation also uncovered a compromised analytics service that spread malicious code through otherwise legitimate websites, putting visitors’ mobile data and authenticated online sessions at risk.
A hijacked analytics service extended the campaign's reach
Researchers first discovered malicious JavaScript on a Ukrainian gas producer's website. Sekoia's investigation also identified infected pages belonging to a US chemical industry trade association and a European political party. On a Bulgarian military-related website, hackers had tampered with an existing JavaScript library, another example of the watering-hole tactics used in advanced persistent threat campaigns.
Attackers also registered lookalike domains impersonating America250 and Raffles London at The OWO hotel. Visitors saw content retrieved from the legitimate websites, but the fraudulent addresses secretly inserted malicious scripts into the pages.
A separate software supply chain compromise extended the operation through Plerdy, a Ukrainian web analytics provider. Between Aug. 27 and Sept. 3, hackers modified its JavaScript tracker, which was loaded by thousands of predominantly Ukrainian websites, including sites associated with military organizations and defense equipment. Visitors could encounter the injected script even when the websites themselves had not been directly breached.
Mobile exploits target saved passwords and private information
Once loaded, the injected script gathered information about a visitor's operating system and browser before contacting attacker-controlled infrastructure. Vulnerable devices could then receive compatible exploits automatically, without additional clicks or software downloads.
By testing different browser profiles against the delivery server, investigators recovered three complete exploit chains with distinct data-theft capabilities.
Observed targeting | Vulnerabilities | Information targeted |
|---|---|---|
| iOS 16.7 | CVE-2025-43529, CVE-2024-27834 | Stored authentication cookies |
| iOS 18.5 | Five-vulnerability DarkSword chain | Messages, Keychain credentials, photos, and other device data |
| Chrome for Android 139–145, excluding 143 | CVE-2026-3910, CVE-2025-27038 | Browser cookies, saved logins, browsing history, and Wi-Fi passwords |
One iPhone exploit chain incorporated DarkSword, a toolkit documented by Google in March after researchers observed its use by multiple threat actors. An earlier investigation also linked suspected APT29 activity to mobile cookie theft through compromised Mongolian government websites.
All recovered chains relied on vulnerabilities patched before the campaign began, leaving fully updated devices protected against these specific attacks. None established persistence, but restarting a phone would not undo any data theft. Investigators did not establish how many devices were successfully compromised.
Stolen mobile sessions raise enterprise account security concerns
Employees use smartphones to access corporate email and cloud applications, creating potential business exposure when authentication data is stolen. Depending on a service's protections, session hijacking could give attackers access to those accounts without first breaching an organization's network.
Security teams can address the risk through three priorities.
- Restrict access from vulnerable devices. Combine mobile device management with identity-based access policies to enforce minimum operating system and browser versions before phones can access sensitive business applications.
- Examine potentially affected accounts. Check available DNS, proxy, and mobile-security logs for contact with Sekoia’s published malicious infrastructure, then review potentially affected accounts for suspicious sessions. A clean device scan alone does not rule out earlier data theft.
- Invalidate compromised access. Revoke affected sessions and reset exposed credentials from a trusted device when evidence supports compromise. Installing security updates cannot invalidate authentication data already captured by attackers.
Permissions attached to an employee's account should guide how urgently security teams escalate suspected compromise. Administrative access to critical systems can turn a single-device incident into a company-wide security concern.
More on mobile security: Google’s November security bulletin includes approximately two dozen critical vulnerabilities affecting Android’s core software and hardware components.