Russian APT29 Hackers Turn Trusted Websites Into Traps to Compromise iPhone and Android Users

Russian state-sponsored APT29 compromised legitimate and lookalike websites to silently fingerprint visiting devices and serve targeted exploits against unpatched vulnerabilities in older iOS and Android versions — a classic watering hole attack. The root cause is a failure in patch management: users and organizations running outdated mobile operating systems remained exposed to known vulnerabilities that had available fixes. This matters because even cautious users who avoid suspicious links can be compromised simply by visiting a trusted website, making unpatched devices an organization-wide liability. The theft of sensitive data from executive or privileged-user devices can cascade into broader enterprise compromise, espionage, or credential harvesting.