APT29 hackers hit iPhone and Android users with zero-click spyware

Sekoia said APT29, a group also known as Cozy Bear and Midnight Blizzard and believed to work for Russia’s Foreign Intelligence Service, ran a zero-click espionage campaign against iPhone and Android users in Ukraine, the United States, and Europe, disclosing the operation on November 4, 2026.

Zero-click means the campaign required no action by the people targeted. A JavaScript loader profiled each visitor’s browser and device, then served platform-specific exploit chains. Three vectors carried that loader: harmful JavaScript on real websites, fake domains copying well-known sites, and a compromise of the Ukrainian analytics service Plerdy. Sekoia’s Threat Detection and Research team found the operation in mid-October 2026.

Attackers injected code into Plerdy’s tracking script from August 27 to September 3, 2026. The script ran on thousands of Ukrainian websites, including army, special forces, and military equipment sites, potentially exposing visitors to hundreds of sites.

On iPhones running iOS 16.7, attackers linked CVE-2025-43529 and CVE-2024-27834 to take cookies and reuse active webmail sessions. On iPhones running iOS 18.5, a chain called DarkSword used five linked flaws to pull messages, e-mails, passwords, contacts, photos, location data, and messaging app data. Apple had patched CVE-2024-27834 in May 2024 through iOS 16.7.8 and iOS 17.5. Sekoia said all flaws in the chains had been patched before the campaign began, so updated devices were safe.

Android phones using Chrome versions 139 through 145, skipping 143, faced exploitation of CVE-2026-3910 and CVE-2025-27038 that took Chrome cookies, logins, browsing history, and Wi-Fi passwords. The Android payload, AndroSnitch, sent data away without installing anything that remained after transmission. The chain ended when it found a Samsung Galaxy S25 Ultra carrying model identifier SM-S938B.

On November 4, 2026, CISA listed CVE-2024-27834 in its Known Exploited Vulnerabilities catalog based on active exploitation, though it did not tie the activity to APT29. The agency gave affected U.S. federal civilian agencies until November 18, 2026 to remediate.

Sekoia gave the watering hole campaign‘s connection to APT29 a confidence rating of moderate to high. The case relied on a 2025 watering hole trace, a 2024 Mongolian government campaign confirmed by Google, and a victim list centered on Ukraine. Microsoft reported that APT29 spent months during the summer of 2026 breaking into Wi-Fi networks at hotels and conference centers, gathering Microsoft 365 credentials and distributing malware.

The campaign follows earlier mobile spyware activity tied to the same actor. The name AndroSnitch comes from ANDROSNATCH, a payload Google described in August 2024 as a Chrome cookie stealer linked to a suspected APT29 operation. DarkSword is a suspected commercially developed surveillance tool used by other threat actors against users in Saudi Arabia, Turkey, and Malaysia.

Shortly before this finding, researchers showed that DarkSword P7 moved through half-click attacks, among them a World Cup-themed Instagram ad hosted at ad-track[.]live. Separately, DeadTag uses expired domains connected to old analytics and advertising tags that stay live on thousands of websites to push harmful JavaScript to iPhones. DeadTag’s network covers more than 660 expired and re-registered domains. Zimperium zLabs counted 608 domains serving Coruna-family code in October 2026 after the toolkit spread to many threat actors.

Compromised sites included a U.S. chemical industry trade association, a far-right European political party, a Bulgarian military-linked organization, and an Australian medical clinic. False domains imitated America250 and Raffles London at The OWO, a hotel close to the UK Ministry of Defence and 10 Downing Street. Public reports said Volodymyr Zelensky was at the Raffles in London for an October visit, though researchers found no sign anyone targeted him. Sekoia said several of the compromised sites likely attract important people tied to the Russia-Ukraine war.

Sekoia said it was unclear whether the people behind the campaign aimed at specific targets or tried to infect as many unpatched mobile devices as possible. The firm also said it never counted the compromised smartphones or measured the stolen information.

Sekoia started its investigation after malicious code turned up on a Ukrainian gas company’s website. The firm worked with national computer emergency response teams, including CERT-UA, to locate victims and shut down the watering hole infrastructure.

TechRepublic said stolen credentials and browser sessions from employee smartphones could expose corporate information, creating risks for bring-your-own-device policies where IT teams have limited visibility into personal phones. Sekoia said reusing surveillance tools such as DarkSword lowers the cost and technical bar for mobile exploitation and will probably spread among state-sponsored groups.

TechRepublic advised users to look for unfamiliar sign-ins on email, banking, cloud storage, and work accounts, and to enable phishing-resistant multifactor authentication when available. Phones without security updates should be replaced since they may stay open to known flaws. Anyone who suspects a breach should change important passwords from a trusted device and end active sessions, because stolen authentication cookies may remain valid.

IT administrators should find outdated phones, watch for suspicious account activity, inspect third-party website scripts, and review compromise indicators to check employee exposure, TechRepublic said. Apple phone owners should open Settings, then General, then Software Update, while Android users should apply system, security, and manufacturer patches before updating Chrome through Google Play. Rebooting an affected phone might halt active malicious processes because the payloads had no persistence, though it would not recover stolen data or patch vulnerabilities.