A sophisticated cyber-espionage operation has targeted owners of iPhones and Android devices, according to French cybersecurity firm Sekoia. Researchers assess with moderate to high confidence that the campaign is linked to APT29, a hacking group associated with Russia’s Foreign Intelligence Service.
The operation, codenamed Poisoned Source, was detected in mid-October 2026. It used compromised websites, lookalike domains and a hijacked Ukrainian web analytics service to reach selected mobile users.
The attackers relied on “watering hole” tactics. They compromised or created websites likely to attract people of interest, including one marking the 250th anniversary of the signing of the Declaration of Independence.
They also ran spear-phishing campaigns using fake calendar invitations and event notifications. When a target opened the malicious page, injected JavaScript profiled the visitor’s browser and device.
That profiling helped the hackers choose an exploit chain suited to the victim’s phone. Some attacks reportedly required no user interaction and used zero-click exploits.
On Android devices, the malware reportedly collected Chrome cookies, saved credentials, browsing history and Wi-Fi passwords. The attackers did not appear to establish persistence on affected Android phones.
The campaign aimed to steal browser cookies, saved logins, browsing history and Wi-Fi passwords. On some iPhones, the attackers could allegedly access messages from SMS, iMessage, WhatsApp and Telegram, along with Keychain passwords, location data, health information and photos.
Sekoia said the hackers used n-day exploits, which target publicly known vulnerabilities for which patches are available. The affected software included iOS 16.7 and iOS 18.5, as well as Chrome versions 139 to 145 on Android.
The key protection is simple: Users who have installed the latest security updates should be protected against the specific vulnerabilities used in these exploit chains. The campaign does not appear to target every smartphone user. State-sponsored groups generally focus on officials, journalists, activists, researchers and organisations with access to valuable information.
Also Read: AI-Driven Cybersecurity Flaws Raise Fears of Global Outages