A cyberespionage campaign linked to Russia’s APT29 hacking group used compromised websites and a hijacked analytics script to target iPhone and Android users. Visiting an affected page was enough to trigger an attack on a vulnerable device, potentially exposing browser sessions,…
Published 4 Nov 2026, 23:26 UTC APT29 used watering holes exploiting patched iOS/Android flaws to steal cookies and messages Campaign targeted visitors of trusted websites across US, Ukraine, Czech Republic, and Bulgaria 8 outlets told this the same way. UltimateFingerprinter hides inside a mostly…
A large-scale watering hole campaign that it assesses, with moderate to high confidence, is the work of APT29. APT29 is also tracked as Midnight Blizzard, Cozy Bear and The Dukes, and is widely linked to Russia’s SVR foreign intelligence service. The operation…
Fake job interviews are an established way to target developers Written by Ross McKerchar Developers are attractive targets. Their laptops and accounts often reach source code, build systems and production infrastructure, so attackers put real effort into getting onto them.
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO…
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant…
Active since at least February 2025, the group targets government agencies, law enforcement bodies, justice institutions, local administrations near the front line, and defense organizations. The campaign favors quick data theft over extended remote control. Its malware collects information in a…
A cyberespionage campaign attributed to Russia's APT29 has served exploit chains for already-patched iPhone and Android flaws to visitors of legitimate websites, with payloads built to steal cookies, device data and Wi-Fi passwords without any user interaction. Sekoia uncovered the activity…
Russia’s APT29 has been using compromised websites, lookalike domains and a hijacked web analytics service to target iOS and Android users with exploits for patched flaws and steal their cookies, messages and Wi-Fi passwords, according to Sekoia. APT29 watering holes target mobile…
Threat Detection & Research (TDR) team has uncovered a large watering hole campaign. It targets iPhone and Android users through hacked websites, fake lookalike domains, and a poisoned analytics service. Sekoia assesses with moderate to high confidence that APT29 is behind it.
Campaigns tied to state actors and their cutouts.
An article joins this feed when it matches these terms. Each one is also a search of its own.