Russian-linked hackers associated with APT29 are conducting a watering hole campaign that targets iOS and Android users via compromised websites and lookalike or fake domains. Multiple outlets say the activity uses “n-day” exploits—attacks leveraging flaws that have patches—and aims to extract information from victims’ devices, including session-related data and network credentials.
Help Net Security and The Hacker News both attribute the findings to Sekoia’s threat research, describing how malicious scripts are injected through compromised sites and, in one account, via a supply-chain component. The Hacker News specifically frames the delivery mechanism as involving a hijacked web analytics script connected to Plerdy SEO Tracker. Bleeping Computer similarly describes the campaign as using n-day exploits in attacks that do not require user interaction, while noting targets are reached when users visit the malicious or impersonating pages.
