Russian-Linked Hackers Use Trusted Websites to Attack Phones That Missed Security Updates

A cyberespionage campaign linked to Russia's APT29 (also known as Midnight Blizzard and Cozy Bear) has targeted people who simply visited compromised websites, according to Sekoia. The researchers found the activity in mid-October 2026 and published their findings on November 4. They assessed with moderate to high confidence that APT29, or one of its subgroups, was responsible. The group is widely attributed to Russia's Foreign Intelligence Service (SVR).

The attackers used three routes: scripts injected into legitimate sites, lookalike domains that copied real sites, and a week-long compromise of Plerdy, a Ukrainian website analytics tracker. That compromise ran from August 27 to September 3 and exposed hundreds of sites and their visitors. Affected sites included Ukrainian and other European military-related sites and a US chemical-industry trade association. Visitors were fingerprinted and served exploits matched to their devices, with no user interaction required. The payloads stole cookies, device data and Wi-Fi passwords, and did not establish persistence. Sekoia did not say how many devices were compromised.

The exploits relied on flaws that were already disclosed and patched, targeting specific versions of iOS and Chrome on Android. Unlike an earlier APT29 campaign, this one had no filter limiting which sites or visitors it targeted, and it collected any cookies in the browser. That makes unpatched devices the common weak point.