Russian APT29 hackers use trusted websites to hack outdated iPhones and Android phones
THREAT ACTORAPT29redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Researchers at Sekoia attribute a campaign with moderate to high confidence to APT29, which used compromised sites, lookalike domains and a hacked Ukrainian SEO tracker to deliver device-specific exploits. The loaded script, UltimateFingerprinter, selects iOS 16.7, iOS 18.5 or Android Chrome targets, and the payloads steal cookies, saved logins, messages and other data without setting up lasting access. Fully patched iOS and Chrome versions are reported as safe, so the main defence is updating devices and replacing those no longer receiving updates.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update iOS and Chrome on iPhones and Android phones to the latest versions.
- Replace phones that no longer receive security updates.
- Check logs for the listed malicious domains and IP addresses.
- Review which third-party scripts your websites load.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Threat actors
Malware