Russian APT29 hackers use trusted websites to hack outdated iPhones and Android phones
- Severity
- High
- Sources
- 1
What happened
APT29 (Sekoia, moderate to high confidence) ran watering hole and lookalike-site campaigns, and between 27 August and 3 September 2026 altered the Plerdy tracker file to deliver UltimateFingerprinter. Class A targets iOS 16.7 (CVE-2025-43529, CVE-2024-27834) and steals cookies. Class B targets iOS 18.5 via the DarkSword kit (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520) and takes messages, Keychain, photos and iCloud files. Class C targets Android Chrome 139 to 145 except 143 (CVE-2026-3910, CVE-2025-27038) and deploys AndroSnitch. Defenders should update iOS and Chrome, retire unsupported devices, hunt for the listed IoCs and audit third-party script loads.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update iOS and Chrome on iPhones and Android phones to the latest versions.
- Replace phones that no longer receive security updates.
- Check logs for the listed malicious domains and IP addresses.
- Review which third-party scripts your websites load.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Malware