Russian Intel Hackers Troll Mobile Devices for Login Cookies

Russian state intelligence hackers used lookalike and compromised websites to conduct a large-scale watering hole campaign against mobile devices, using known vulnerabilities to snatch browser cookies and other data.

See Also: What If Your Security Licensing Could Adapt to Your Cloud?

Researchers from cybersecurity firm Sekoia identify with moderate to high confidence Russia's Foreign Intelligence Service as the perpetrator, a group tracked variously as APT29, Cozy Bear and Midnight Blizzard. Sekoia detected the campaign in mid-October.

The campaign targeted many high-profile websites, including those of a Ukrainian gas production firm, a trade association representing U.S. chemical companies, America250 and a Bulgarian military-related organization. It also compromised a Ukrainian third-party web analytics service to reach additional websites.

"At first glance, the targets appear unusually scattered," Sekoia researcher Amaury-Jacques Garçon told ISMG. "In a watering hole campaign, however, looking only at the compromised websites rarely tells the full story. The pattern makes much more sense through the lens of individual-centric targeting, where attackers compromise the specific sites a person of interest is known to visit."

The campaign's payload is delivered by infecting legitimate websites with JavaScript injection or by registering phishing domains that act as reverse proxies to high-profile websites. Hackers also compromised a web analytics tool made by the Ukrainian company Plerdy. The threat actor exploited known, already-patched vulnerabilities in each attack, targeting out-of-date devices.

Garçon said researchers were able to piece the activities together because the actor reused the same filename for its malicious JavaScript throughout the campaign. The matching filename helped researchers find additional delivery servers controlled by the attacker.

"From those servers, and using internet indexing and scanning platforms - such as URLScan, PublicWWW, URLQuery, Censys, and Shodan, we were able to identify a large number of victims across all three infection vectors, all pointing back to the same delivery infrastructure," Garçon said.

Sekoia contacted Ukraine's incident response team CERT-UA and an unnamed partner organization. The joint investigation confirmed that traces on one of the compromised websites matched an earlier watering hole campaign attributed to the same Russian group in 2025.

"While this is a strong indicator, our attribution is further supported by other factors: TTPs matching a 2024 APT29 watering-hole campaign against the Mongolian government as reported by Google TAG, the operator's use of multiple autonomous systems, and a victimology aligned with Russian strategic interests," Garçon said.

Instead of establishing persistence on infected devices, the threat actor solely focuses on intelligence collection, making the compromises a stepping stone for identity and cloud-based intrusions, Garçon said.

Browser authentication cookies can give access to corporate webmail, cloud collaboration suites and internal web portals without needing the user's password or triggering multifactor authentication. Social media and text messaging logs and contacts can be used to conduct spear phishing. And other stolen secrets can lead to account takeovers or give attackers network-level access to a target system.

Garçon said Sekoia has contacted 25 providers and hosting companies to take down the malicious domains and IP addresses related to the campaign.