Russia's APT29 targets iOS and Android users through compromised websites
THREAT ACTORAPT29redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Sekoia's TDR team identified a watering hole campaign in mid-October 2026, which it assesses with moderate to high confidence as attributable to APT29. The operation combines compromised websites, lookalike domains and a hijacked web analytics service to deliver n-day exploits against patched iOS and Android flaws, with the aim of harvesting cookies, messages and Wi-Fi credentials. No CVE identifiers or affected versions are given in the available text. Defenders should keep iOS and Android devices on current OS and browser builds and treat unexpected web redirects as suspicious.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update iOS and Android devices to the latest available software to close patched flaws.
- Be cautious of unexpected websites or lookalike web addresses, especially those reached through links.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Help Net Security
Who and what is in it
Threat actors
Companies