Threat Intelligence

Russian Hackers Turn Compromised Websites Into Traps for Mobile Users

Dark Reading · 6 Nov 2026

Key Takeaway Keep phones and mobile browsers fully updated and include mobile devices in your security policies, because even trusted websites can be compromised.

The Russian state-sponsored threat group known as APT29 is running a watering hole campaign that targets thousands of mobile users. In a watering hole attack, criminals first compromise a legitimate website that their intended victims are likely to visit, so the trap sits somewhere people already trust.

According to the report summary, the group then fingerprints visitors to the compromised sites. Fingerprinting means collecting details about a visitor's device and setup so the attackers can decide who is worth pursuing. Once they have picked out the victims they find interesting, they move on to harvesting information from them.

The summary does not give further technical detail, so this article does not speculate on the specific methods used or the exact data targeted. The central point is that a site you rely on can be turned against its visitors without any obvious sign, and that mobile devices are firmly in the sights of well-resourced attackers.

APT29 watering hole mobile security state-sponsored threat intelligence

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.