Sekoia said it found a large website-based attack on iPhones and Android phones in mid-October 2026. It has moderate to high confidence that APT29, a Russian group tied to the SVR intelligence service, is behind it. Sekoia said sites in the US, Ukraine, the Czech Republic and Bulgaria were broken into or copied. From 27 August to 3 September, the group also tampered with Plerdy, a Ukrainian analytics tracker, exposing hundreds of sites.
Injected code loads a script that profiles the visitor's phone and browser. The server then sends exploit chains matched to that system, with no tap needed. The fuller chains run code in the browser, break out of its sandbox, then steal data. All use n-day flaws, meaning bugs the vendors already fixed, so fully updated devices are safe, Sekoia said. iPhones lost cookies or full device data. Android phones lost Chrome data and Wi-Fi passwords. The malware does not install itself to stay on the phone, but the data it takes is gone once sent. Sekoia does not know whether the attackers wanted certain visitors or any unpatched phone.
Patch lag on phones is the exposure, and a third-party script is the route. Ask whether staff phones, personal ones included, must install OS and browser updates. List and limit the third-party scripts on your sites. If exposure is suspected, rotate passwords and end sessions, since patching does not undo the theft.