Visit one poisoned page and your signed-in accounts may be exposed

Attackers used booby-trapped websites to target iPhones and Android phones running unpatched software, according to French security firm Sekoia, potentially exposing signed-in accounts and other sensitive data. ^[2]

Sekoia said it discovered the campaign in mid-October 2026 and published its findings on November 4. Its investigation describes malicious code planted on legitimate websites, lookalike sites that copied real ones, and a compromised Ukrainian web analytics service used by thousands of sites. ^[2]

The suspected targets included diplomats and other high-profile visitors to a London hotel. Sekoia attributes the operation with moderate to high confidence to APT29, a hacking group widely attributed to Russia's Foreign Intelligence Service. That is the firm's assessment, rather than an established Kremlin connection. ^[2]

The campaign has not been independently confirmed. No count of infected phones or specific victims has been published, and the full extent of any data theft is unknown. ^[1][2]

For phone owners, the most useful finding is also the least exotic: Sekoia says the attacks used vulnerabilities for which fixes already existed. An available update left uninstalled was the opening the attackers needed. ^[2]

A web page could be enough

A phone exploit uses a flaw in software to make the device run code chosen by an attacker. In this campaign, Sekoia said, JavaScript, the programming language that makes web pages do things, loaded through an affected page first checked the visitor's browser and device, then selected an attack suited to iOS or Android. ^[2]

That selection matters. An exploit built for one software version will not necessarily work against another. Profiling lets an attacker send the matching sequence of exploits, known as an exploit chain, rather than trying the same attack against every visitor.

According to Sekoia, once someone reached an affected page, the attack could proceed without another tap or permission prompt. The dangerous act was loading the page on a device with the right unpatched flaw. ^[2]

The intended haul varied by platform. Sekoia said the iOS payloads sought browser cookies and, in some cases, broader device data. The Android payloads targeted Chrome data and Wi-Fi passwords. ^[2]

Cookies can include the tokens that keep someone signed into a web service. Stealing those tokens can allow an attacker to reuse an authenticated browser session, according to Sekoia. That makes them valuable even without the person's password: an account already signed in can be an account ready to enter. ^[2]

The researchers said they found no persistence mechanism, meaning the attack did not set itself up to remain on the phone. That finding offers limited comfort where the objective is theft. An attacker who has copied useful data does not need a permanent foothold to have done damage. ^[2]

One iOS attack chain used DarkSword, a kit previously documented by Google's threat intelligence team. Google's March 18 investigation said it had seen DarkSword in separate campaigns since at least November 2025, involving commercial surveillance vendors and suspected state-backed actors. Apple had patched the vulnerabilities Google identified. ^[2][4]

That history shows the kit has circulated among different operators. It does not independently verify this campaign or identify its operator. Sekoia did not name two other exploit chains in its public investigation. ^[2][4]

Why impersonate a hotel?

Among the lookalike sites was theowo[.]club, which Sekoia said relayed content from the website of Raffles London at The OWO. Another, america250[.]holiday, did the same with the America250 website. ^[2]

This technique, called a reverse proxy, lets a malicious address present content from a real site. The visitor can see the material they expected while the attacker adds code around it. Sekoia said these impersonations were one of three routes used to deliver the same malicious code. ^[2]

The hotel provides the clearest clue to the researchers' theory about the intended audience. Sekoia noted its proximity to the UK Ministry of Defence and 10 Downing Street. The firm also cited public accounts indicating that Ukrainian President Volodymyr Zelenskyy stayed there during an October 14 visit. ^[2]

Sekoia suggests the imitation hotel site may have been designed to reach diplomatic delegations and high-profile guests. A diplomat's phone is a prize because it can hold access to email and other services, as well as messages, contacts and travel information. ^[2]

Planting malicious code where a chosen group is likely to browse is known as a watering-hole attack. Its advantage is simple: the attacker waits at a place the target has a reason to visit.

The campaign also had a much wider delivery route. Sekoia said attackers compromised Plerdy, a Ukrainian web analytics service that helps websites understand their traffic, between August 27 and September 3, 2026. The service was loaded by thousands of websites. Visitors were exposed to malicious code for one week, and many affected sites were Ukrainian. ^[2]

A shared website component can therefore give an attacker reach far beyond a single decoy. The number of sites using Plerdy describes the potential distribution channel, not a count of infected phones.

Check the updates, not just the address

Sekoia's attribution to APT29 rests on technical overlaps, operating patterns, the apparent targets and infrastructure. The group is also known as Midnight Blizzard, Cozy Bear and The Dukes. ^[2]

Whatever the operator's identity, the immediate defensive step follows from the flaws used: install available operating-system and browser updates. Sekoia describes these as n-day vulnerabilities, meaning fixes had been issued before the campaign used them. ^[1][2]

Apple lists iOS 27.2, released on October 26, 2026, as its latest iOS version and says keeping software current is among the most important security steps users can take. ^[5]

For Android users, Google's November bulletin says a security patch level of November 5, 2026 or later addresses the issues listed in that bulletin. Google also encourages updating to the latest Android version where possible. Those are general update benchmarks, not confirmation from either company of this campaign. ^[3][5]

Sekoia said it is coordinating with affected countries' computer emergency response teams to identify victims and assess ways to disrupt the campaign's infrastructure. That work is the next step toward establishing who was actually reached. ^[2]