Russia-Linked Hackers Target iOS, Android Users

Russia-linked hackers from the Midnight Blizzard group targeted iOS and Android users in Europe and the United States through compromised and cloned websites, according to cybersecurity firm Sekoia. The campaign used previously patched vulnerabilities to steal data from mobile devices.

The attacks formed part of a watering-hole campaign. Visitors to selected websites were profiled through injected JavaScript, which collected browser and device information in JSON format. An exploit was delivered when a visitor matched the attackers’ criteria.

The affected sites were linked to organizations in the United States, Ukraine, the Czech Republic and Bulgaria. The hackers added JavaScript to the websites of a Ukrainian gas producer, an industry trade association and a far-right European political party. They modified legitimate files on a Bulgarian website linked to the military.

Midnight Blizzard registered lookalike domains that acted as reverse proxies for high-profile websites. The domains included copies of america250.org, which marks the 250th anniversary of American independence, and the website of Raffles London at The OWO hotel.

The hotel is near British government institutions and has hosted high-profile visitors, including Ukrainian President Volodymyr Zelensky during a visit on Oct. 14, based on open-source information cited by Sekoia.

The group compromised Ukrainian web analytics provider Plerdy and added malicious code to its tracker file. The supply-chain attack exposed hundreds of websites to the exploit kit for about a week. The affected sites included pages linked to armies, special forces and military equipment, including ballistic systems and unmanned aerial vehicles.

Sekoia identified three exploit chains: two for Apple devices and one for Android phones. All three used vulnerabilities that had already been patched.

The first iOS chain used code from the DarkSword exploit kit to gain read and write access. It then exploited CVE-2024-27834 to bypass Apple’s Pointer Authentication Codes protection and run code outside Safari. Apple patched the flaw in May 2024 across supported versions of iOS, iPadOS, macOS, Safari, tvOS and watchOS. The Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on Wednesday and gave federal agencies two weeks to apply the relevant updates.

A second iOS chain used DarkSword for initial access, code execution and higher privileges. The resulting payload collected messages, emails, voicemails, credentials, authentication tokens, contacts, call records, calendar entries, browser cookies and history, photos, and iCloud Drive files.

The Android chain used CVE-2026-3910, a Chrome vulnerability patched in March 2026, and CVE-2025-27038, a Qualcomm flaw addressed in Android’s August 2025 security update. Its payload, called AndroSnitch, targeted Chrome cookies, account details, passwords, browsing history and Wi-Fi passwords. Sekoia found similarities between AndroSnitch and AndroSnatch, a Chrome cookie-stealing tool previously linked to Midnight Blizzard activity.

“The adoption of packaged n-day exploit chains lowers the cost and technical threshold required to conduct advanced mobile exploitation,” Sekoia wrote. The firm added that state-sponsored groups may increasingly reuse exploits from commercial surveillance vendors.

Midnight Blizzard is also known as APT29, Cozy Bear, The Dukes, Nobelium and Yttrium. The group is believed to be linked to Russia’s Foreign Intelligence Service and has targeted government agencies, diplomats, information technology providers and nongovernmental organizations for intelligence collection.