A sophisticated cyberespionage campaign linked to the Russian Foreign Intelligence Service group APT29 has targeted mobile device users through watering hole attacks, with further coverage provided by Infosecurity Magazine.
Researchers at Sekoia identified the activity in October 2026, attributing the operation to the group also known as Midnight Blizzard or Cozy Bear. The attackers utilized three primary delivery methods, including script injection on legitimate websites, the use of lookalike domains and a week-long compromise of the Ukrainian analytics platform Plerdy. This campaign successfully exposed visitors to various sites, including those related to Ukrainian military interests, a United States chemical industry association and international organizations. The attackers employed n-day exploits to target vulnerabilities in iOS and Android devices, allowing for the silent theft of cookies, device data and Wi-Fi passwords without user interaction. Notably, the campaign lacked specific filters, casting a wide net to capture data from any visitor. While the exploits were sophisticated, they targeted flaws that had already been patched by software vendors. Security experts emphasize that users maintaining up-to-date operating systems remain protected from these specific exploit chains. The findings suggest that the threat actors likely acquired these technical capabilities from a third-party commercial surveillance vendor.
Source: Infosecurity Magazine
