Russian hackers breach smartphones even through trusted sites. The only safeguard: update your software
The APT29 group (also known as Cozy Bear or Midnight Blizzard), linked to Russian special services, uses legitimate and copied websites to discreetly steal data from unupdated iOS and Android smartphones.
As analysts from Sekoia discovered in mid-October 2026, attackers embedded malicious code on real and fake resources in the USA, Ukraine, Czech Republic, and Bulgaria, according to Cybersecuritynews portal.
The attack occurred in three ways: through direct infection of websites (specifically, a Ukrainian gas production company and a military portal in Bulgaria), creating phishing copies (for example, a replica of the Raffles London hotel website in the UK near the Ministry of Defense), and compromising the Ukrainian SEO-tracker Plerdy, through which the UltimateFingerprinter script landed on thousands of other platforms.
When a user with an older system version visits such a site, a script hidden in the AngularJS library checks the device and launches an appropriate exploit chain. On older iPhones (from iOS 16.0 to iOS 18.5), using the DarkSword exploit kit, hackers can steal cookies, passwords from Keychain, WhatsApp and Telegram databases, photos, contacts, and files from iCloud Drive. The current iOS version is 27.
On Android smartphones with Chrome browser versions 139-145, the malicious program AndroSnitch collects saved logins, browsing history, and Wi-Fi settings, inexplicably bypassing the Samsung Galaxy S25 Ultra model. The current Chrome version is 156.
All stolen data is sent to the hackers' server without persistence in the system, which indicates rapid collection of intelligence, primarily against diplomats and the military sector. Since the attack exploits already known vulnerabilities, the only reliable defense is to urgently update iOS and Chrome browser to the latest versions or replace devices that are no longer supported by manufacturers.
To protect your smartphone from similar attacks, experts advise adhering to several rules:
- Urgently update your system and browsers: Install the latest versions of iOS, Android, and Google Chrome, as exploits only work on old, already fixed developer bugs.
- Replace old devices: If your phone no longer receives current security updates from the manufacturer, it remains defenseless against such attacks.
- Enable Lockdown Mode on iPhone: If you are at risk, this feature in Apple's security settings strictly limits the execution of complex web scripts in the browser.
- Use two-factor authentication with physical keys (YubiKey) or code generator apps (OTP) and regularly terminate unknown active sessions in your email, Telegram, and WhatsApp settings.
«Nasha Niva» — the bastion of Belarus
SUPPORT USNow reading
Killed his family while they slept, was interested in "Nazis and the Aryan race." What else is known about the case of the 24-year-old shooter in Krakow 1919
Killed his family while they slept, was interested in "Nazis and the Aryan race." What else is known about the case of the 24-year-old shooter in Krakow 19
The soloist of a Russian band at a concert in Minsk, it seems, was resuscitated by an ambulance — afterwards he sang in semi-darkness to a backing track 1313
The soloist of a Russian band at a concert in Minsk, it seems, was resuscitated by an ambulance — afterwards he sang in semi-darkness to a backing track 13
An Ugly Monument to a Woman Was Erected in Bykhau. Together with the sculpture in Kastsiukovichy, it could become a symbol of cultural degradation in Belarus under Lukashenka 6565
Comments