Sekoia Ties Mobile Hacking Campaign Using Patched iPhone and Android Flaws to Russian Intelligence Group APT29

A hacking campaign tied to Russian intelligence went after iPhone and Android users through hijacked websites, fake lookalike sites and a poisoned analytics script. The attacks used flaws that Apple and Google fixed long ago.

Sekoia's Threat Detection and Research team published its findings today, Wednesday, Nov. 4. The firm found the operation in mid-October 2026 and codenamed it "Poisoned Source." It assesses with "moderate to high confidence" that the group behind it is APT29, also tracked as Midnight Blizzard or Cozy Bear, which is linked to Russia's Foreign Intelligence Service (SVR).

Three ways in

Sekoia identified three infection routes. All of them delivered the same JavaScript loader.

The first was direct injection of malicious code into legitimate websites. Those included a Ukrainian gas production company, a US chemical industry trade association, a far-right European political party and a Bulgarian military-related organization.

The second was lookalike domains that relayed the real content of the genuine sites while adding malicious script. The attackers registered america250[.]holiday to mirror america250.org, the site of the initiative marking 250 years of American independence. They registered theowo[.]club to mirror Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street.

The third was a supply-chain compromise. Between Aug. 27 and Sept. 3, 2026, the attackers served their code through the tracking script of Plerdy, a Ukrainian web analytics service. That script runs on thousands of websites, mostly Ukrainian, including sites run by the army, special forces and military equipment makers.

What the code did

The loader profiled each visitor's browser and device. The server then picked a platform-specific exploit chain that needed no click or download from the victim.

On iPhones, one chain targeting iOS 16.7 went after Safari cookies. Another, aimed at iOS 18.5, used the DarkSword exploit kit to pull WhatsApp and Telegram databases, saved credentials, location data and photos. DarkSword was first documented in March and has been used by multiple threat groups since at least November 2025.

On Android, the malware targeted certain versions of Chrome to take browsing data, cookies and saved Wi-Fi passwords. The final payload, dubbed AndroSnitch, shares traits with a Chrome cookie stealer Google documented in August 2024 in connection with a suspected APT29 campaign against visitors to a Mongolian government website. The Android chain also checks whether the device is a Samsung Galaxy S25 Ultra and stops if it is.

Sekoia says none of the payloads set up persistence. Rebooting a phone ends the malicious activity until the user visits an infected site again.

Why Sekoia points to APT29

The attribution rests on the victim profile, similarities to earlier APT29 watering-hole operations, infrastructure overlaps, and a compromised site that a partner tied to a 2025 APT29 campaign. It is an assessment, not a confirmation from any government.

The group has recent form. Microsoft reported over the summer that APT29 spent months hijacking hotel and conference-center Wi-Fi networks to steal Microsoft 365 credentials and deliver malware.

Sekoia suggested the America250 clone may have been picked for its link to a high-profile national celebration, possibly as a pretext for invitation-themed spear-phishing. It said the hotel clone may have been aimed at diplomatic delegations and prominent guests. Open-source reporting indicates Ukrainian President Volodymyr Zelenskyy stayed at the OWO during a visit on Oct. 14.

What is still unknown

Sekoia does not know how many devices were compromised. It also cannot say whether the operators wanted visitors to specific sites or simply tried to infect as many unpatched phones as possible, then sorted the stolen data for anything of interest.

Some compromised sites had no obvious strategic value. One was an Australian medical clinic. Sekoia believes, with low confidence, that sites like it may have been used to reach specific individuals.

The report also gives differing scales for the analytics compromise, describing both thousands of sites loading the script and hundreds of legitimate sites exposed.

What users can do

Apple and Google have patched every flaw used in the campaign, and Apple's fixes reached older iOS releases. Sekoia's analysis indicates that a user on an up-to-date operating system is safe from these particular attacks.

That leaves the exposure with people running old iPhones and outdated Chrome builds, and with anyone who put off an update notification. The campaign also shows that nobody has to click a suspicious link. Visiting a trusted site could be enough on an unpatched phone.

Whether Western governments or the affected organizations respond remains to be seen. No government attribution or response has been announced as of today, Nov. 4. The organizations whose sites were abused, including the America250 initiative, the US chemical trade group and the Ukrainian gas producer, have not publicly detailed what they are doing about it.