APT29 mobile watering-hole campaign steals cookies, messages, Wi-Fi passwords

En bref

• APT29 used compromised sites and lookalike domains to target mobile users.
• Hijacked analytics code helped deliver the watering-hole attack.
• Stolen data included cookies, messages and Wi-Fi credentials.
• No CVE was assigned; known flaws were abused.
• Sekoia details emerged on 4 November 2026.

APT29, a crew described as Russian hackers, ran a mobile-focused watering-hole operation that began in mid-October 2026. According to Sekoia, the group seeded compromised websites and lookalike domains, then used a tampered analytics service to reach visitors on iPhones and Android handsets. The result was mobile device compromise, with attackers pulling cookies, text messages and saved Wi-Fi passwords.

The targeting is notable because it blends web-layer abuse with mobile data theft. A watering-hole campaign does not need a new exploit chain if it can redirect trusted traffic or abuse known but unpatched flaws. Sekoia's reporting points to abuse of existing vulnerabilities rather than a zero-day, and no CVE has been attached to the activity. That makes patch latency and third-party script trust the practical control points.

Apple and Google platform owners are affected at the user level, not because of a single vendor defect called out in the facts. The stolen material can enable session hijacking, message disclosure and network access through recovered Wi-Fi credentials. Organizations with BYOD or managed mobile fleets should treat the campaign as a credential and session-integrity problem, not only a browsing nuisance.

The public detail surfaced on 4 November 2026. Watch for domain clusters that mimic legitimate brands, unexpected analytics script changes, and mobile users reporting odd session resets or message access. Because no CVE is listed, signature-only patching will not be enough; inventory third-party JavaScript, validate analytics vendors, and shorten the window between mobile OS updates and deployment.

À faire maintenant

1. Inventory and freeze third-party analytics and tag-manager scripts; require vendor integrity attestations and review recent changes.
2. Patch mobile OS and browsers to the latest versions; prioritize devices exposed to known but unpatched flaws and track update compliance.
3. Block or alert on newly registered lookalike domains and campaign indicators from Sekoia; feed DNS and proxy logs into detection.
4. Force re-authentication and revoke sessions for mobile users showing suspicious cookie or session activity; rotate Wi-Fi credentials where exposure is suspected.
5. Harden mobile email and messaging access with phishing-resistant MFA and conditional access; reduce cookie lifetime where possible.
6. Deploy mobile threat defense or EDR telemetry on managed iOS and Android fleets; monitor for unusual profile, network, or message access.
7. Brief users on watering-hole risks and fake domains; ask them to report unexpected login prompts or message access.

Source originale

Help Net Security