Sekoia
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Activity reported by Help Net SecurityRussia's APT29 targets iOS and Android users through compromised websites
- Activity reported by Cyber Security NewsRussian APT29 hackers use trusted websites to hack outdated iPhones and Android phones
Recent news
Russia's APT29 targets iOS and Android users through compromised websites
Sekoia reports that APT29 is running a watering hole campaign against iOS and Android users using compromised websites, lookalike domains and a hijacked web analytics service. The attackers use n-day exploits for flaws that have already been patched, and aim to steal cookies, messages and Wi-Fi passwords. Sekoia's Threat Detection & Research team spotted the operation in mid-October 2026.
Russian APT29 hackers use trusted websites to hack outdated iPhones and Android phones
Researchers at Sekoia attribute a campaign with moderate to high confidence to APT29, which used compromised sites, lookalike domains and a hacked Ukrainian SEO tracker to deliver device-specific exploits. The loaded script, UltimateFingerprinter, selects iOS 16.7, iOS 18.5 or Android Chrome targets, and the payloads steal cookies, saved logins, messages and other data without setting up lasting access. Fully patched iOS and Chrome versions are reported as safe, so the main defence is updating devices and replacing those no longer receiving updates.