Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users

A Russian state-linked hacking group is using trusted websites to quietly break into phones. Researchers say APT29, also known as Midnight Blizzard or Cozy Bear, planted hidden code on real and cloned sites in the US, Ukraine, the Czech Republic and Bulgaria.

Visitors with out-of-date iPhones or Android phones can lose cookies, Wi-Fi passwords and, in some cases, almost all of their phone data. They only need to open the page.

The campaign was found in mid-October 2026. It uses three entry routes: code added directly to hacked sites, lookalike sites that copy real ones, and a one-week break-in at a Ukrainian web analytics service.

All three load the same script, which checks the visitor’s device and sends a matching exploit. The exploits use old, already-patched flaws, so fully updated phones are safe.

Analysts at Sekoia identified the campaign and the malicious scripts behind it. They say with moderate to high confidence that APT29 is responsible. They are working with the CERTs of affected countries to find victims and try to shut down the infrastructure.

Russian APT29 Hackers Turn Trusted Websites Into Traps

The first route was simple. The attackers added a few lines of JavaScript to the main page template of a Ukrainian gas production company. Once the page loaded, the code quietly pulled a script from a server the attackers controlled.

Sekoia also found the same trick on the site of a US chemical industry trade group, a far-right European political party and a Bulgarian military-related site.

When the attackers could not break into a site, they copied it. They registered two lookalike domains, america250[.]holiday and theowo[.]club.

These acted as middlemen for the real America250 site and the website of Raffles London at The OWO, a hotel near the UK Ministry of Defence and 10 Downing Street.

Visitors saw the real content, but the attackers slipped malicious code into each page. Sekoia thinks the goal was to reach diplomats and high-profile guests.

The widest net came from Plerdy, a Ukrainian SEO tracker used by thousands of sites. Between 27 August and 3 September 2026, the attackers altered its tracker file, so every site that loaded it also loaded the attackers’ script.

Many of the affected sites were linked to the military and defense sector. The loaded script is called UltimateFingerprinter. It is hidden inside a large copy of the AngularJS library, which makes up about 98 percent of the 2.3 MB file.

Sekoia believes this was meant to confuse automated analysis tools or to make the file look harmless. The script collects 394 data fields from 61 checks, but it mostly blocks only odd devices, such as those with huge screen sizes or no touch support.

This is not APT29’s first watering hole campaign. Google’s Threat Analysis Group tied a similar Mongolian government website campaign to the group in 2024.

Amazon also reported an APT29 watering hole campaign in 2025 that sent visitors to fake Cloudflare checks.

Exploit Chains, Stolen Data and Ways to Stay Safe

Sekoia recovered three exploit chains, which it named A, B and C. Class A targets iOS 16.7 and steals cookies. It uses CVE-2025-43529 and CVE-2024-27834, and it sets a marker cookie so the exploit does not run twice on the same phone.

Class B is the most invasive. It targets iOS 18.5 and is the DarkSword exploit kit leaked online earlier this year. It chains CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520.

After that, it takes messages, WhatsApp and Telegram databases, Keychain passwords, contacts, call history, location caches, photos and iCloud Drive files.

Class C goes after Android phones running Chrome versions 139 to 145, except 143. It uses CVE-2026-3910 and CVE-2025-27038, a flaw in the Adreno graphics driver.

The final payload, named AndroSnitch, copies Chrome cookies, saved logins, history and Wi-Fi settings. It stops if it finds a Samsung Galaxy S25 Ultra.

All stolen data goes to ad.starx-net[.]com. None of the payloads set up lasting access, which fits quick intelligence gathering. Stolen cookies could let the attackers reuse logged-in sessions, including webmail.

Sekoia sees signs that the exploits came from a third party. For example, the server checks for iOS 16.7, but the exploit works on iOS 16.0 to 17.4.

The researchers say reuse of commercial surveillance exploits by state groups will likely grow. Other researchers have also warned about Coruna and DarkSword kits that hit outdated iPhones from a single web visit.

The defense is simple. Update iOS and Chrome now, and replace phones that no longer get updates. Teams should also check logs for the domains below and review who has loaded third-party scripts.

Indicators of compromise (IoCs):-

Domains and IP Addresses

File Hashes (SHA-256)

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users appeared first on Cyber Security News.