A 4 November Sekoia report describes mobile exploitation delivered through compromised and cloned websites. The researchers attribute the campaign to APT29 with moderate-to-high confidence.
The investigation, begun in mid-October, identified direct website injections, lookalike sites acting as reverse proxies and compromised Plerdy tracking infrastructure. Sekoia dates the tracker compromise to 27 August–3 September 2026 and describes sites in the United States, Ukraine, the Czech Republic and Bulgaria.
The researchers found three exploit chains targeting iOS and Android Chrome. These used previously patched vulnerabilities, rather than newly discovered zero-days. Sekoia says none works against fully updated devices.
Payloads collected cookies and, depending on the chain, broader iOS device data or Android Chrome data and Wi-Fi passwords. Sekoia reports that the payloads did not establish persistence. Exposure through a website does not establish that every visitor was infected; the report does not provide a proven victim count.
The patch gap reaches into mobile browsing
For defenders, this is a reason to include phones in patch verification. A trusted website can become an entry point when its own code or a shared dependency is compromised. Reviewing only suspicious domains leaves that trust relationship unexamined.
On Android, Google’s official update guidance explains how to check three separate details in Settings: the Android version, Android security update and Google Play system update. Under System → Software updates, users can check update status and follow the device’s instructions.
Google notes that availability depends on the device, manufacturer and carrier. Older devices cannot always run newer Android releases. That makes a recorded update status more useful than assuming that an automatic-update setting guarantees current protection. Browser updates should also be verified separately from the operating system.
