Severity: High | Priority: 1
Security researchers have uncovered a watering-hole campaign that they attribute with moderate to high confidence to APT29, also known as Midnight Blizzard or Cozy Bear. Rather than sending phishing messages, the attackers compromise websites their targets already trust and use them to attack visitors’ mobile phones. Affected sites were found in the United States, Ukraine, the Czech Republic and Bulgaria. They include a Ukrainian gas company, a US chemical industry association, a European political party and a Bulgarian military website.
The campaign used three routes. First, the attackers injected hidden code directly into legitimate websites. Second, they set up lookalike sites that copy real websites in real time while adding their own code. One copied the America250 commemorative site, and another copied the Raffles London at The OWO hotel. Third, for about a week between 27 August and 3 September 2026, they tampered with a widely used Ukrainian web analytics script. During that week, visitors to thousands of websites using the script, many of them linked to the military and defence sector, were silently exposed. In every case, a fingerprinting script profiles the visitor’s device in detail and then serves an exploit chain matched to it. The victim doesn’t need to click anything: simply opening the page is enough.
The exploits target older, unpatched versions of iOS and of Chrome on Android. On iPhones, the lighter chain steals browser cookies. A full chain, believed to come from a commercial surveillance vendor, can take messages, Keychain passwords, Wi-Fi credentials, photos and location data. On Android, the exploit targets Chrome versions 139 to 145, excluding 143, and steals Chrome cookies, saved passwords, browsing history and Wi-Fi information. Stolen cookies can let the attacker take over the victim’s web and email sessions without needing a password. The malware does not survive a reboot, but the stolen data and sessions remain usable long after the infection ends. Devices fully updated to current iOS and Chrome versions are not affected.
Organisations should make sure all iPhones are on a current iOS release, and that Chrome on Android devices is fully updated. Use mobile device management to find iPhones still on older iOS 16 or 17 versions, and Android devices running Chrome 139 to 145. Replace devices that no longer receive updates. Any device that contacted this infrastructure should be treated as having had its browser sessions and saved credentials stolen. Sign the user out of all web, email and cloud sessions, reset passwords stored on the device, and change the Wi-Fi credentials of networks it connected to. Organisations that run websites should review all third-party scripts they load, restrict them with a strict Content Security Policy, and check whether they used the affected analytics service during the compromise window. They should also watch for lookalike domains copying their own site.