Russian hackers target iOS and Android users with n-day exploits
ID: 06736152-74a0-5071-8585-9ed6ebef4ed6
STIX ID: report--06736152-74a0-5071-8585-9ed6ebef4ed6
Feed Name: Help Net Security
Threat Score
Sekoia observed an active APT29 watering‑hole campaign (mid‑Oct 2026) delivering platform‑specific n‑day exploit chains to iOS and Android visitors via direct JavaScript injection, adversary‑in‑the‑middle lookalike domains, and a compromised Ukrainian web analytics provider; payloads exfiltrated cookies, messaging, Keychain and Wi‑Fi credentials without persisting, targeted high‑value sites (military, hotels, gas producers) and reused packaged exploit frameworks like DarkSword.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.