search
APT29
Trends
- 1APT29-linked watering holes exploit unpatched iOS and Android devices▼APT29-linked watering holes hit unpatched iOS/Android with zero-click n-day chains (incl. CVE-2026-20700). Compromised s
Watering hole attacks attributed to APT29 are hitting visitors of compromised websites with zero-click exploit chains targeting unpatched iOS and Android devices, reportedly including CVE-2026-20700. The intrusions use hijacked analytics scripts to steal cookies, chat data and Wi-Fi passwords. Security commentators urge users to patch devices promptly.
- 2APT29 watering hole attacks now target mobile devices▼New. Sekoia: Poisoned Source: APT29 watering holes target mobile devices with n-day exploits https://www. sekoia.com/blo
French cybersecurity firm Sekoia.io published new research titled Poisoned Source describing how APT29, a hacking group widely linked to Russian intelligence, compromised websites with watering hole attacks aimed at mobile devices using recently patched (n-day) exploits. The findings, also covered by The Hacker News, indicate the group is broadening its tradecraft beyond desktop targets, prompting discussion among security researchers.
- 3Sekoia uncovers APT29 mobile campaign Poisoned Source●French cybersecurity firm Sekoia has uncovered a web-based campaign dubbed Poisoned Source, tracked since mid-October 20
French cybersecurity firm Sekoia has uncovered a web-based campaign dubbed Poisoned Source, tracked since mid-October and attributed to the Russian-linked threat group APT29. The operation targeted iOS and Android users by compromising legitimate websites and injecting malicious code, a technique observers note as an evolution toward mobile-focused espionage. Security researchers are sharing technical indicators and warning organizations to review exposed sites.
- 4APT29-linked attack poisons Plerdy SEO tracker●🤖 APT29-linked "Poisoned Source": supply-chain compromise of Plerdy SEO Tracker injects JS into thousands of sites, prof
A supply-chain compromise of the Plerdy SEO analytics tool reportedly injected malicious JavaScript into thousands of websites. The code profiles each visitor and delivers mobile exploits: iOS visitors receive 'DarkSword', harvesting cookies and device data, while Android users get 'AndroSnitch', targeting Chrome and Wi-Fi credentials. Researchers at Sekoia link the campaign to APT29, the Russian state-aligned hacking group, prompting renewed warnings about third-party script risks.