APT29 Exploits Compromised Sites to Profile Mobile Visitors and Steal Data

Key points

• APT29, tied to the Russian government, is running the campaign
• Legitimate but hijacked sites are used to reach phone users
• Devices are profiled and information is collected without a software flaw
• Several thousand mobile visitors are estimated to be in scope
• No CVE means patching alone will not detect or stop it

APT29, an intrusion set widely tied to Russia’s government, has shifted part of its collection effort toward people browsing on phones. Rather than relying on a software flaw, the operation uses legitimate websites that have already been taken over. Visitors to those sites are quietly examined, and information is gathered from their devices and sessions. Because no CVE is attached, conventional patch-and-scan programs will not flag the activity.

The campaign is aimed at mobile audiences and is estimated to reach several thousand people. That scale matters for schools and public agencies, where staff, students, and families increasingly use personal phones for email, learning portals, and notices. A compromised site that looks ordinary can serve as a collection point without ever delivering malware. The intruders appear to be sorting visitors into profiles before deciding what to take, a step that raises the value of each visit and makes detection harder.

For K-12 and government organizations, the risk is less about a single vulnerable server and more about trust in everyday web browsing. Staff who visit an infected site from a district phone may expose credentials, session data, or other sensitive details. The fact that this is an intelligence-gathering operation, not a broad ransomware event, means losses may be quiet and slow to notice.

Watch for unusual redirects, unexpected prompts, or site behavior that changes by device type. Network teams should monitor outbound traffic from mobile devices and review web proxy logs for patterns that suggest profiling. Awareness messages should remind users that a familiar website can still be hostile. No patch will close this gap; controls must focus on browsing hygiene, segmentation, and rapid reporting.

What to do now

1. Block or alert on known compromised domains as indicators become available, and monitor DNS and proxy logs for mobile traffic to suspicious sites.
2. Enforce web filtering, secure DNS, and network isolation for district-managed phones; require managed devices to use approved access paths.
3. Review authentication and access logs for unusual activity from mobile devices, and reset credentials for users who visited flagged sites.
4. Send a short awareness notice focused on unexpected redirects, device-specific prompts, and reporting suspicious browsing immediately.
5. Collect browser history and mobile device logs from affected users, preserve evidence, and coordinate with threat intelligence partners.
6. Segment guest and BYOD networks, and restrict access to sensitive systems from unmanaged phones until the scope is clear.
7. Update incident response playbooks for drive-by collection that does not involve malware, and brief leadership on quiet data loss risk.

Original source

Dark Reading