Security research: APT29 suspected of attacking mobile devices through compromised websites

Security firm Sekoia has attributed a large-scale campaign targeting iOS and Android users to APT29 with medium-to-high confidence, after detecting the activity in mid-October. Attackers delivered exploit chains through compromised legitimate websites, typosquatted sites, and a tampered web analytics script—Plerdy's, altered between August 27 and September 3. The payloads steal browser cookies and, in some cases, Wi-Fi passwords and device data. All observed exploit chains targeted already-patched vulnerabilities, so fully updated devices were unaffected. The findings matter because they extend APT29's known tradecraft from desktop to mobile browsers and third-party scripts, widening the supply-chain surface. What to watch next: whether additional analytics or tag-management vendors were compromised, and whether patched-but-unpatched devices show follow-on account takeovers.