Security Research: APT29 Suspected of Attacking Mobile Devices via Compromised Websites

on November 5, a research report by security firm Sekoia revealed a large-scale attack campaign targeting iOS and Android users, with attackers deploying exploit chains via compromised legitimate websites, fake sites, and tampered web analytics services.

Sekoia stated that it detected the campaign in mid-October and attributed it to APT29 with medium-to-high confidence. The payload can steal browser cookies, and in some cases, also obtain Wi-Fi passwords or device data.

Researchers noted that all discovered exploit chains target patched vulnerabilities and cannot compromise fully up-to-date devices. Specifically, the Plerdy analytics service script was tampered with between August 27 and September 3.