Sekoia has detailed a large-scale APT29 watering hole campaign targeting iOS and Android users through compromised websites. The security firm says the campaign was conducted by APT29, a Russian nexus intrusion set widely attributed to the Foreign Intelligence Service of the Russian Federation (SVR). Sekoia says the attackers exploited a Google Chrome vulnerability and a flaw in Qualcomm's Adreno GPU driver to compromise Android devices. The campaign was reportedly designed to steal sensitive information. It is said to have targeted Chrome versions 139 to 145.
APT29 Hackers Exploited Chrome and Qualcomm GPU Flaws
Security researchers at Sekoia have uncovered a large-scale cyberattack campaign targeting mobile device users across the US and Europe, with a heavy focus on Ukraine. The firm attributed the campaign to APT29, which is believed to be linked to Russia's Foreign Intelligence Service (SVR), with moderate-to-high confidence. The campaign uses compromised websites and supply-chain tricks to steal browser cookies, Wi-Fi passwords, and sensitive device data.
The cybersecurity firm said the investigation began with the detection of a malicious JavaScript inclusion leading to an attacker-controlled exploit delivery server at the top of a Ukrainian gas production company. Sekoia's report states that the Android attack involved two vulnerabilities. The first, tracked as CVE-2026-3910, was exploited to execute malicious code within Google Chrome. The attackers then used CVE-2025-27038, a security flaw in the Adreno GPU driver, to escape Chrome's sandbox and gain access to the affected device.
Since the Adreno GPUs are used in Snapdragon-equipped smartphones, devices running these chipsets were potentially exposed to the attack. The exploit reportedly targeted Chrome versions 139 through 145, while version 143 was excluded.
After compromising a device, the attackers deployed malware identified by Sekoia as AndroSnitch. The malware reportedly collected Chrome cookies, saved login information and browsing history. It also said to have accessed Wi-Fi configuration files containing saved network passwords. Stolen browser cookies could also allow attackers to access accounts where users were already signed in.
Android exploit reportedly included a mechanism to stop its execution if it detected a Samsung Galaxy S25 Ultra. Sekoia did not identify any other specific smartphone models or Android versions that were excluded from the campaign. The attackers reportedly used multiple methods to direct victims towards malicious content, such as injecting harmful code into legitimate websites, creating fraudulent copies of existing websites and compromising a Ukrainian web analytics service used by thousands of websites.
The compromised analytics service was reportedly exploited between August 27 and September 3. Impersonated websites include a fake version of the America250 website and a fraudulent website resembling a luxury hotel in London.
Sekoia claims that iPhone users were targeted through separate exploit chains. One reportedly stole browser cookies from devices running iOS 16 through iOS 17.4, while another attack using the DarkSword exploit could access messages, photos and passwords on devices running iOS 18.5.
Security experts note that the widespread reuse of commercial surveillance vendor tools like the DarkSword exploit kit lowers the technical barrier for state-sponsored threat actors. It recommends that users keep their software, browser, and operating system updated.
Comments
Post a Comment