Russian-Linked Hackers Target iPhones and Android Devices Through Trusted Websites

An investigation into a mobile cyberespionage campaign raises new concerns about compromised websites, third-party scripts and the risks facing users of vulnerable smartphones.

By Open Chronicle News Desk

November 6, 2026 | Shadow Protocols | Cybersecurity & Intelligence

The most dangerous cyberattack is not always the one that arrives in a suspicious email.

Sometimes, the threat may be hidden inside a website that users already trust.

A newly disclosed cybersecurity investigation has drawn attention to a sophisticated mobile espionage campaign attributed by researchers to APT29, a hacking group widely associated with Russia’s Foreign Intelligence Service, the SVR.

The operation, described as Poisoned Source, reportedly exploited compromised websites and third-party web infrastructure to reach vulnerable iPhones and Android devices.

Rather than relying exclusively on fraudulent messages, attackers could potentially deliver malicious code when a targeted user visited an affected webpage.

The investigation illustrates a growing challenge for digital security: the difference between a legitimate website and a trustworthy browsing experience is becoming increasingly difficult to establish.

A website may belong to a reputable organisation while still loading malicious code from an external service that has been compromised.

For intelligence agencies, this creates opportunities to collect sensitive information without directly breaching the networks of their intended targets.

APT29: The Intelligence Operation Behind the Allegations

APT29 is among the most extensively documented cyberespionage groups operating internationally.

The group is also known by names including Cozy Bear, The Dukes and Midnight Blizzard.

Western governments and cybersecurity agencies have associated its activities with Russia’s SVR, although attribution of individual operations remains dependent on the available technical and intelligence evidence.

APT29 has historically concentrated on targets with strategic intelligence value, including government institutions, diplomatic organisations, political entities and technology providers.

Its operations have frequently involved sophisticated credential theft, exploitation of trusted infrastructure and attempts to maintain access to sensitive information.

The latest reported campaign suggests that smartphones are becoming an increasingly important part of this intelligence environment.

Mobile devices routinely contain personal messages, professional communications, authentication tokens, location information and access to cloud services.

Compromising a smartphone can therefore reveal information extending far beyond the device itself.

How a Legitimate Website Can Become an Espionage Tool

Modern websites rarely operate entirely independently.

Many rely on external services for analytics, advertising, performance measurement and customer interaction.

These services frequently use JavaScript, a programming language executed by web browsers.

Ordinarily, such scripts provide legitimate functionality.

But if attackers compromise an external service, malicious code may be distributed through websites that continue to appear normal to their visitors.

This is one of the central concerns raised by the Poisoned Source investigation.

Researchers described methods involving compromised legitimate websites, imitation domains and the manipulation of third-party infrastructure.

One reported component involved Plerdy, a web analytics service whose tracking script was allegedly modified during a limited period.

The significance of this technique lies in its potential reach.

Instead of compromising each website separately, an attacker may be able to exploit a shared dependency used by multiple sites.

This is a form of supply chain compromise.

The attack does not necessarily mean that every website using the affected service was successfully exploited or that every visitor was infected.

The outcome depends on the malicious code, the devices involved and the vulnerabilities available to the attackers.

Why iPhones and Android Devices Were Targeted

The reported operation focused on mobile browsers and operating systems.

Researchers described mechanisms capable of examining characteristics of visiting devices before selecting an appropriate exploitation method.

Such information can help attackers determine whether a smartphone is running a vulnerable software version.

In certain circumstances, the attacker may then attempt to exploit a browser or operating-system weakness.

The important distinction is that the attack can begin through an ordinary website visit.

A victim does not necessarily need to download an attachment or approve the installation of an application.

However, the term zero-click requires care.

A malicious website exploiting a vulnerability during a visit is not automatically equivalent to a fully remote attack that requires no action whatsoever from the user.

The investigation should therefore be understood in terms of the specific exploitation mechanisms described by researchers.

The Value of Stolen Browser Sessions

One of the most consequential risks associated with mobile exploitation is the theft of authentication material.

When users sign in to websites, their browsers may store session cookies that allow them to remain authenticated.

These cookies are essential to the normal functioning of many online services.

But stolen session information can sometimes be misused to impersonate an authenticated user.

An attacker may not need to know the original password if a service accepts the stolen session as valid.

The practical consequences depend on the security controls implemented by the service.

Some systems detect unusual activity, require additional verification or invalidate suspicious sessions.

Others may be more vulnerable to session hijacking.

For intelligence operations, access to professional email, cloud documents and communication platforms can be particularly valuable.

A compromised personal smartphone may therefore create risks for an organisation even when its internal network remains protected.

The Problem With Third-Party Trust

The campaign highlights a structural weakness in the modern internet.

Website owners often trust external service providers to deliver scripts safely.

Users, in turn, trust the websites they visit.

These overlapping relationships create dependencies that attackers can exploit.

A single compromised component may expose multiple organisations and their visitors.

The challenge is especially serious because malicious modifications can be difficult to detect through ordinary visual inspection.

A webpage may look exactly as expected while running unauthorised code in the background.

Security teams increasingly need to examine not only their own software but also the external resources loaded by their websites.

This includes understanding which services have access to the browsing environment and whether changes to their scripts are monitored.

Three Exploit Chains, Different Objectives

Sekoia identified three principal exploit chains used in the operation.

One targeted older iOS versions and focused on extracting browser cookies.

A second involved DarkSword, an exploit framework associated with mobile surveillance activity. This chain reportedly enabled the extraction of a much wider range of information from vulnerable iPhones, potentially including messages, credentials, photographs and location data.

A third targeted particular versions of Chrome on Android and used a payload identified as AndroSnitch to collect browser information and saved Wi-Fi credentials.

The vulnerabilities exploited in these chains had already been patched by Apple and Google before the campaign was uncovered.

This is a crucial point.

The operation was not evidence that every iPhone or Android smartphone could be compromised simply by opening a webpage.

It targeted specific vulnerable software configurations. Keeping devices updated was therefore an effective defence against the particular exploit chains documented by Sekoia.

Ukraine, the United States and European Targets

The investigation identified compromised or impersonated websites associated with Ukraine, the United States, the Czech Republic and Bulgaria.

Some affected web properties had connections to energy, military or defence-related activities.

The compromise of Plerdy’s analytics infrastructure was particularly significant because the service was loaded by thousands of websites, predominantly in Ukraine.

Researchers reported that the malicious modification was present between August 27 and September 3, 2026.

The operation could therefore have exposed visitors across numerous unrelated websites during that period.

However, exposure to malicious code is not the same as confirmed successful exploitation.

Sekoia did not publish a verified count of compromised smartphones.

Nor did the investigation establish that every affected website had been deliberately selected as an intelligence target.

The researchers suggested that the attackers might have been searching for particular individuals or valuable credentials within a wider pool of visitors.

That remains an assessment rather than a confirmed account of the operation’s full objectives.

Why the Campaign Matters for European Security

The reported targeting pattern has implications beyond consumer cybersecurity.

Ukraine’s government, defence industry, energy infrastructure and international partners have faced sustained cyberespionage threats during Russia’s war against Ukraine.

Compromised smartphones can provide access to information that may be difficult to obtain through conventional attacks on institutional networks.

A diplomatic official, defence contractor or government employee might use a personal device to access professional communications.

If an attacker obtains valid authentication material from that device, the consequences could extend to cloud services and organisational accounts.

This does not establish that the Poisoned Source campaign successfully penetrated any particular government institution.

It explains why intelligence-linked actors might consider mobile devices valuable targets.

The investigation also highlights the growing importance of commercial surveillance technology.

Tools initially developed or distributed within the commercial exploit market can potentially be reused by different operators, including groups associated with national intelligence services.

Sekoia warned that this reuse may become increasingly common as sophisticated exploit frameworks circulate between actors.

What Individuals Should Do

For ordinary smartphone users, the findings support a straightforward security principle: install operating-system and browser updates promptly.

The documented attack chains exploited vulnerabilities for which fixes were already available.

Users should also review the security of important online accounts, enable strong authentication where possible and remain alert to unexpected account activity.

Individuals who believe they may have been specifically targeted should seek assistance from a qualified security professional rather than assuming that a routine antivirus scan will identify every form of mobile exploitation.

For organisations, the recommendations extend further.

Security teams should maintain inventories of external scripts, monitor changes to third-party services and assess the risks associated with employees accessing sensitive systems through unmanaged devices.

Session management and account monitoring are also important because some of the reported payloads focused on authentication data rather than long-term control of the smartphone.

What Remains Unconfirmed

Despite the technical detail presented by Sekoia, several questions remain open.

The total number of successfully compromised devices has not been established publicly.

The full amount of information stolen remains unknown.

The precise identities of the individuals operating the infrastructure have not been publicly established through judicial proceedings.

The attribution to APT29 is a technical intelligence assessment expressed with moderate to high confidence.

Sekoia reported cooperation with national computer emergency response teams, including Ukrainian authorities, to support victim identification and investigate possible disruption of the infrastructure.

These limitations are essential to understanding the findings.

They distinguish documented attack mechanisms from broader conclusions about responsibility, victim numbers and strategic consequences.

Conclusion | When Trust Becomes the Attack Surface

Poisoned Source illustrates a fundamental change in the way sophisticated cyberespionage operations can reach their targets.

Attackers may not need to compromise a government network directly.

They may instead exploit the ordinary websites, browsers and external services used by people who possess valuable information.

The campaign combined compromised websites, deceptive domains and a hijacked analytics component with mobile exploit chains targeting already-patched vulnerabilities.

Its most important lesson is therefore not that smartphones are inherently defenceless.

It is that digital security increasingly depends on the interaction between device maintenance, software dependencies and the management of trusted services.

For intelligence agencies, that interconnected environment creates opportunities.

For governments, businesses and individual users, it creates a responsibility to examine where trust is placed and how quickly it can be withdrawn when something goes wrong.

The next espionage operation may not begin with a suspicious message. It may begin with a familiar webpage.