State-linked mobile campaign turns trusted websites into attack paths
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, November 6th, 2026.
Passwords, messages and location history could be stolen from vulnerable phones simply by visiting a compromised or imitation website. Researchers attributed the campaign to Russia-linked APT29. The group planted device-fingerprinting code on legitimate sites, convincing lookalikes and a Ukrainian analytics service used by thousands of websites. Its exploit chains then targeted older iPhones and Android devices.
Importantly, the campaign used known vulnerabilities that Apple and Google had already patched, rather than new zero-days. Users in Ukraine, the United States and Europe were targeted, although the number of successful compromises remains unknown. For leaders, executive, diplomatic and sensitive-workforce phones should be treated as high-value endpoints. For defenders, rapid mobile updates are essential, along with investigation of account anomalies where cookies, tokens or passwords may have been exposed. Fully updated devices weren’t vulnerable to the reported chains.
Enforce current mobile updates, keep outdated devices away from sensitive work and investigate unusual account activity involving users who may have been exposed.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
