Sekoia Links Mobile Watering Hole Campaign to Russia-Linked APT29

What happened

Security firm Sekoia says the Russia-linked threat actor known as APT29 is behind a large watering hole campaign (an attack in which visitors to booby-trapped websites are infected) aimed at iOS and Android users. Sekoia says the attackers use compromised websites, lookalike domains and a supply chain attack on a Ukrainian web analytics service called Plerdy SEO Tracker. ^[1][2]

Sekoia's Threat Detection & Research team spotted the operation in mid-October 2026 and assesses with moderate to high confidence that APT29 is responsible. Ars Technica reports the targeted sites included one celebrating the 250th anniversary of the signing of the US Constitution, and describes the Kremlin link as possible. ^[2][3]

How the attack works

Sekoia says injected JavaScript collects browser and device attributes from visitors. The attackers then deliver exploits for previously patched flaws, known as n-day exploits, to iPhones and Android phones. Sekoia says the operation steals cookies, messages and Wi-Fi passwords. ^[1][2]

BleepingComputer describes the attacks as zero-click, meaning a visit to an affected page is enough, and as targeting visitors of compromised sites or fake ones impersonating legitimate portals. ^[4]

What is not yet known

The available coverage does not say how many devices were infected, which specific vulnerabilities were used, or how many sites carried the malicious script. ^[1][2][3]