APT29 Hackers Exploit Web Analytics to Launch Mobile Attacks

Cybersecurity researchers have uncovered a sophisticated campaign orchestrated by hackers linked to the Russian state-sponsored group known as APT29. The attackers have successfully hijacked trusted web analytics scripts to deliver malicious exploits targeting both iOS and Android mobile devices, marking a significant escalation in the use of ’n-day’ vulnerabilities.

By compromising legitimate websites and injecting malicious code into their analytics tracking scripts, the threat actors were able to turn these trusted platforms into traps. When unsuspecting users visited these sites, their mobile devices were automatically scanned for vulnerabilities. If a device was found to be running unpatched software, the attackers would deploy zero-click exploits to gain unauthorized access or infect the device with malware.

This method of attack is particularly dangerous because it does not require the user to click on a suspicious link or download a malicious file. Instead, the mere act of browsing a compromised, yet otherwise reputable, website is sufficient to trigger the infection process. The hackers reportedly created fake versions of well-known US and UK websites to lure victims into this trap, demonstrating a high level of planning and technical sophistication.

Security experts emphasize that this campaign highlights the critical importance of keeping mobile operating systems and browsers fully updated. Because the attackers are leveraging known vulnerabilities that have existing patches, the most effective defense remains the timely installation of security updates. The incident serves as a stark reminder that even the most secure-looking websites can be weaponized, and that mobile users are increasingly becoming the primary targets for advanced persistent threat groups looking to compromise sensitive data.

Sources: The Hacker News, Ars Technica, BleepingComputer, GBHackers News, CyberSecurityNews

Aggregated summary. Original: The Hacker News