A suspected Russian state hacking group has been infecting iPhones and Android phones that visit certain websites, using security holes that Apple and Google fixed long ago. The researchers who found it say a phone running current software is safe.
Security firm Sekoia, which uncovered the campaign in mid-October 2026, says it links the work to APT29, also known as Midnight Blizzard and Cozy Bear, a group widely tied to Russia’s Foreign Intelligence Service. Sekoia puts its confidence in that link at “moderate to high” and says it is working with the national CERTs of affected countries.
In its technical report, Sekoia describes three ways visitors were reached: code planted on compromised sites, lookalike domains that copy a real site on the fly, and a hijacked web analytics service. One lookalike mirrored america250.org, the site for the 250th anniversary of American independence. Another copied the website of a London hotel close to Downing Street and the Ministry of Defence. Sekoia also found compromised sites in Ukraine, the Czech Republic and Bulgaria, among them a Ukrainian gas producer and military-related sites.
The analytics tracker, Plerdy, was tampered with between 27 August and 3 September 2026, so thousands of mostly Ukrainian sites loaded the attackers’ script for a week. A script then checked the visitor’s phone and browser and sent a matching exploit chain, with no tap needed from the user.
For iPhones, the chains target iOS 16.0 to 17.4 and the server specifically served iOS 16.7. One is DarkSword, an iOS exploit kit uploaded to VirusTotal in September, which Sekoia says looks like the work of a commercial surveillance vendor. In the version it examined, the payload copies messages, the WhatsApp and Telegram databases, saved passwords and tokens from the Keychain, contacts, call history, photos and location data. A simpler iOS 16 chain steals browser cookies.
On Android, the exploit was served to Chrome versions 139 to 145, skipping 143 for reasons Sekoia could not explain. It uses CVE-2026-3910 in Chrome and then CVE-2025-27038 in the Adreno graphics driver to escape the browser sandbox, then collects Chrome data and saved Wi-Fi passwords. Sekoia says the code stops if it finds a Samsung Galaxy S25 Ultra.
None of the flaws used are new. Sekoia says all of them were fixed by Apple and Google before the campaign began, none is a zero-day, and a fully updated device is not affected. Sekoia reads the choice of sites, such as the hotel and military-related pages, as aimed at diplomats and people tied to the war in Ukraine rather than ordinary phone owners, although the analytics compromise could have reached anyone who visited an affected site.
For anyone still on an old iPhone or an unupdated copy of Chrome on Android, the fix is the same as ever: install the latest iOS or Android and Chrome updates.
