cybersecurity firm in mid-October 2026 read more about APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users

Російське угруповання APT29 заражало iPhone та Android без дій користувача через зламані сайти й трекер Plerdy. Які дані викрадали та як захиститися.

APT29-linked attackers use compromised sites and Plerdy analytics to deliver iOS and Android exploits that steal browser and device data.

APT29 hacks trusted websites to exploit outdated iPhones and Android devices, stealing passwords, cookies, and personal data.116 characters

Fake websites linked to APT29 targeted iPhone and Android visitors with mobile exploits. Learn how domain impersonation works and how security teams respond.

APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users

The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and

APT29 Expands Mobile Espionage Operations Through Compromised Websites A new mobile espionage campaign documented by cybersecurity researchers at Sekoia highlights the growing sophistication of state-linked cyber operations targeting smartphone users. The campaign, attributed with moderate-to-high confidence to APT29, abuses compromised legitimate websites to deliver malicious code targeting both Apple iOS and Google Android devices. Rather than relying exclusively on traditional phishing emails or malicious applications, the attackers use a watering-hole strategy, compromising websites that potential victims may already trust or regularly visit.

Russian hackers, likely APT29, are using n-day exploits in zero-click attacks targeting iOS and Andr...

APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users

Sekoia details a watering-hole campaign assessed with moderate-to-high confidence as APT29, using compromised sites and Plerdy to deliver patched iOS and…

APT29 hacks trusted websites to exploit outdated iPhones and Android devices, stealing passwords, cookies, and personal data.116 characters

Researchers at Citizen Lab and Google's Project Zero traced APT29 (Cozy Bear)'s zero-click attack on iOS and Android. This Russian state group exploited vulnerabilities (CVE-2023-XXXX in iMessage parser, CVE-2023-YYYY in media framework) to silently install spyware on diplomats and NGO workers across Europe and the Middle East. Unlike traditional phishing, these bugs run code with just a message or network packet—no taps, no clicks, no consent. Apple and Google pushed emergency patches within 48 hours. Stay vigilant and keep your patches current—your pocket-sized spy agency is watching. 📅 2026-11-06 Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion

Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service.

Russia-linked APT29 hit iPhones, Androids

Russia-linked group APT29 targeted iOS and Android users through hijacked websites and a compromised analytics service.

Illustration: Sekoia links APT29 to mobile spy campaign against iPhones, Android

Sekoia が報告。改ざん・偽のサイトを開くだけで、古い iOS 18.5 からはメッセージや写真まで、iOS 16.7 や Chrome 139〜145 の Android からは Cookie などを盗む。最新なら当たらない。