Russian Hackers Target Mobile Devices in Watering Hole Attack

• •APT29 is behind a new watering hole attack targeting mobile devices.
• •The attack exploits multiple known vulnerabilities in iOS and Android systems.
• •No persistent malware was installed; the focus was on data collection.

Russian state-sponsored hackers, identified as APT29, have launched a large-scale watering hole attack targeting mobile devices. The campaign, detected in mid-October 2026, exploited known vulnerabilities to harvest browser cookies and sensitive data from users visiting compromised or lookalike websites. High-profile targets included sites related to a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military organization. The attack utilized JavaScript injection and phishing domains to deliver malicious payloads without user interaction. Specific vulnerabilities exploited include CVE-2025-43529 and CVE-2026-3910, among others. Researchers from Sekoia confirmed the operation's attribution to APT29 based on similarities to previous campaigns and infrastructure overlaps. No persistence was established on infected devices, indicating a focus on intelligence collection rather than long-term access.