APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
In late 2026, APT29 (Midnight Blizzard), a Russian state-sponsored threat group, executed a large-scale watering hole campaign targeting iOS and Android users across the U.S., Ukraine, Czech Republic, and Bulgaria. Attackers compromised legitimate high-profile websites and created lookalike domains to deliver JavaScript profiling payloads that fingerprinted visitor devices and browser versions. Based on device type, a tailored n-day exploit chain was silently deployed—requiring zero user interaction—to harvest Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, and Chrome login data. The campaign also subverted the Plerdy Ukrainian web analytics tracker, briefly exposing thousands of downstream sites. This campaign underscores a critical shift in nation-state tradecraft: supply chain compromise of analytics scripts combined with zero-click mobile exploitation eliminates traditional phishing dependencies entirely. As mobile devices become primary endpoints for sensitive communications, credential theft via browser-level n-day exploits represents a rapidly escalating threat vector that bypasses conventional endpoint defenses.
Kill Chain
