Russian spies booby-trapped websites to hack unpatched phones, Sekoia says

It all starts with a few lines of JavaScript that have no business being there. In mid-October, the research team at Sekoia, a French cybersecurity company, spots them in the main template of a Ukrainian gas producer's website. Pulling on the thread, it uncovers an espionage campaign aimed at the phones of ordinary visitors. It details the campaign in a report published on November 4.

The attackers do not send a booby-trapped message: they compromise websites their targets visit. Specialists call this technique a "watering hole" attack. The injected script examines the device and the browser version. The attackers' server then sends back a tailored attack chain, which runs with no action from the user other than visiting the page. Sekoia attributes the operation, with "moderate to high" confidence, to APT29, also known as Midnight Blizzard or Cozy Bear. This group is linked to Russia's foreign intelligence service (SVR).

Ukrainian sites, a luxury hotel in London and a fake American site

Besides the gas producer, the compromised sites include a U.S. chemical industry trade association, a Bulgarian site linked to the military world, a Czech far-right political movement and an Australian medical clinic. From August 27 to September 3, the attackers also booby-trapped the tracker of Plerdy, a Ukrainian audience analytics tool. This tracker is loaded by thousands of sites, mostly Ukrainian, including sites tied to the army.

Finally, they built two lookalike sites that relayed the content of the real ones. One copied the official website for the 250th anniversary of the United States, the other that of the Raffles London at The OWO, a luxury hotel next to British government buildings. According to Sekoia, the first could have been used to send fake invitations.

Messaging apps, passwords, photos: what the attackers could take

Sekoia describes three attack chains. On iPhones running iOS 16.7, the first steals Safari cookies, the small files that keep sessions open. According to Sekoia, its exploits work on versions 16.0 through 17.4. On iOS 18.5, the second goes much further. Built from an attack kit called DarkSword, it collects SMS, messages, WhatsApp and Telegram conversations, Keychain passwords, Wi-Fi keys, location and photos. On Android, the third targets Chrome, versions 139 to 145, except 143. It extracts cookies, saved credentials, browsing history and Wi-Fi passwords.

A reconnaissance script also collects 394 device characteristics, but according to Sekoia they have almost no effect on how the attack is delivered. None of the spyware programs installs itself persistently: a restart is enough to stop them, until the next visit to a booby-trapped site.

No unknown vulnerabilities: updating was enough

This is the good news in the report. The eight distinct vulnerabilities used, including CVE-2025-43529, CVE-2026-20700 and CVE-2026-3910, had already been patched by Apple and Google before the campaign. Sekoia stresses that an up-to-date system is protected from these attacks. The targeted devices are therefore the ones that get forgotten: never updated, or stuck on an old version. All three chains relied on already public vulnerabilities, yet they triggered without any click from the victim, like the Candiru spyware attack on Al Jazeera.

A few steps are enough to protect yourself:

• install the latest version of iOS or Android available for your device, and update Chrome. Apple has backported some patches to older versions of iOS;
• in a corporate fleet, list the phones still on iOS 16, 17 or an old version of 18, or running a Chrome version earlier than 146, and set a deadline for updating;
• restart your phones regularly: the spyware described here does not survive a restart;
• if your site loads third-party scripts (analytics, SEO), monitor changes to them: the Plerdy case shows that a single compromised provider can contaminate thousands of sites.

One question remains open: Sekoia does not say how APT29 obtained these tools, but its analysis supports the idea that they come from a third party. According to BleepingComputer, one of them, DarkSword, has been circulating among several attacker groups since at least November 2025.