APT29 Poisons Websites to Target Mobile Users

A Russia-linked group assessed as APT29 compromised legitimate websites, cloned trusted websites, and tampered with a Ukrainian analytics service to target mobile visitors. The campaign delivered exploits to unpatched iPhone and Android devices, with fake sites impersonating a U.S. anniversary initiative and a prominent London hotel potentially used to reach high-value visitors.

Key findings

• APT29 is assessed with moderate to high confidence to be behind a watering-hole campaign targeting iOS and Android users.
• Attackers used three delivery methods: injected JavaScript on hacked sites, cloned websites containing malicious code, and a compromised Plerdy analytics script.
• Two fake sites impersonated America250 and Raffles London at The OWO; the hotel clone acted as a reverse proxy of the legitimate hotel site.
• The Plerdy compromise exposed visitors to thousands of websites, mostly Ukrainian, between August 27 and September 3, 2026.
• The delivered exploit chains stole sensitive mobile data, including browser cookies, saved logins, Wi-Fi credentials, messages, and device data.
• The operation used known, already-patched vulnerabilities; fully updated iOS and Android devices were not vulnerable.

Who’s being targeted

• Commonly targeted roles: Government and diplomatic staff, Defense and military personnel, Executive assistants and travel coordinators, Frequent business travelers, Mobile device users, Security awareness teams.
• Affected industries: Government and diplomatic organizations, Military and defense, Energy, Chemical industry, Political organizations, Hospitality, Healthcare.
• Attack channels: website.
• Impersonated: Raffles London at The OWO, Plerdy web analytics service.

Awareness takeaways

• Verify the web address independently before using hotel, travel, event, or government-related websites, especially when travel involves sensitive meetings or high-profile visitors.
• Keep mobile operating systems and browsers updated promptly; simply visiting a compromised site can be enough to expose an unpatched device.
• Do not assume a familiar website is safe just because its content looks normal; trusted sites and third-party services can be compromised behind the scenes.
• Report unexpected mobile-browser behavior, redirects, or suspicious pages to security teams, particularly when accessing websites related to government, defense, travel, or current events.

Red flags to watch for

• The site uses a lookalike domain rather than the hotel's verified domain.
• A hotel or event website is accessed through an unsolicited or unverified link.
• Users are asked to visit a site related to a high-profile trip or event without independently verifying the URL.
• A legitimate site can be compromised even when its visible content appears normal.
• Mobile operating systems and browsers that are not updated may be exposed simply by visiting a website.
• Unexpected redirects or unusual browser behavior after opening a trusted site should be reported.