Suspected Kremlin-linked iOS and Android exploits used patched flaws to target mobile data

Hackers possibly linked to the Kremlin used iOS and Android exploits against website visitors, turning already-patched flaws into attempts to steal mobile data, security researchers said on November 4, 2026. The campaign combined compromised websites with impersonated pages, including a US anniversary site and a London luxury hotel’s website, to deliver attacks that required no further interaction from visitors. Key takeaways Sekoia linked the campaign to the suspected Russian intelligence group APT29. Malicious JavaScript profiled visitors before attackers selected mobile exploits. Impersonated sites included america250.org and Raffles of London OWO. The payloads sought cookies and, in some cases, passwords and full device data.