Technology and Scienceupdated 1h ago2 min read
Russia’s Foreign Intelligence Service Hackers Inject JavaScript To Steal iPhone And Android Data
8outlets comparedWhere the coverage agrees
6 Other2 Western MainstreamThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
APT29 used watering holes exploiting patched iOS/Android flaws to steal cookies and messages Campaign targeted visitors of trusted websites across US, Ukraine, Czech Republic, and Bulgaria
Save coverage image
8 outlets told this the same way.
Watering holes as traps
Researchers said hackers possibly linked to Russia’s Foreign Intelligence Service exploited previously patched iOS and Android flaws by injecting JavaScript into traffic when iPhone or Android users visited compromised sites. Ars Technica reported that the attackers, assessed with “moderate to high confidence” as part of Russia’s Foreign Intelligence Service, targeted multiple websites including one celebrating the 250th anniversary of the signing of the US Constitution.
Sekoia said the intrusion set “may have deliberately selected this website due to its association with a high-profile national celebration,” potentially using the event as a pretext for invitation-themed spear-phishing campaigns. Researchers said the final payloads were tailored to the type of platform visiting and attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
Three delivery routes
Sekoia researchers said the campaign used three infection vectors, including direct JavaScript injection on legitimate websites and lookalike domains that proxied real sites while adding scripts. “platform-specific n-day exploit chains without user interaction,” with JavaScript profiling visitors to determine browser version and device.
Attackers also compromised websites belonging to a US chemical industry trade association, a Czech political movement, and a Bulgarian military-related organization, and it described a hijacked analytics script as part of the delivery. The Hacker News said the activity, codenamed Poisoned Source, was discovered in mid-October 2026 and used a Ukrainian web analytics service called Plerdy SEO Tracker between August 27 and September 3, 2026.
Patched flaws, stolen data
Sekoia said the campaign exploited specific vulnerabilities to extract cookies, messaging app databases, and credentials, including CVE-2025-43529 and CVE-2024-27834 in iOS 16.7. One iOS chain targeted devices running iOS 18.5 and used the DarkSword exploit kit to collect iMessages, WhatsApp and Telegram databases, Keychain credentials, location data, and photos.
GBHackers News said the Android chain hit Chrome versions 139 to 145 excluding 143 and used CVE-2026-3910 and CVE-2025-27038, with the final payload named AndroSnitch. Sekoia’s analysis supported the idea that “a user running an up-to-date operating system is safe from these attacks,” while researchers said Apple and Google have patched all flaws targeted in this campaign.