Russian cyber operatives target mobile devices through breached websites and cloned portals

Cybersecurity firm Sekoia reports that Russian state-sponsored threat group APT29, also known as Midnight Blizzard, launched a wide-reaching watering hole campaign aimed at iOS and Android devices. The operation struck entities across the United States, Ukraine, the Czech Republic, and Bulgaria by compromising legitimate websites—including a Ukrainian gas producer, a Bulgarian military-linked site, and a U.S. chemical trade association—as well as spoofing portals such as the America250 site and London's Raffles at The OWO hotel. [1][2]

Attackers also altered an SEO tracker from Ukrainian analytics provider Plerdy between August 27 and September 3 to profile incoming traffic. Breached sites deployed JavaScript to fingerprint browser versions and silently deliver tailored exploit chains. On iOS 16.7 and iOS 18.5, the exploits targeted Safari cookies, Keychain credentials, location data, photos, and WhatsApp and Telegram databases. For Chrome on Android versions 139 through 145, excluding 143, the malware gathered saved Wi-Fi credentials, browsing history, and login data. [2]

Sekoia notes that the deployed payloads failed to establish persistence, meaning a simple device reboot terminates the infection until a user navigates back to a compromised webpage. Both Apple and Google have released patches covering all the vulnerabilities exploited in the campaign, making system updates essential to prevent future intrusion. [2]