Cybersecurity researchers at Sekoia have detailed a suspected APT29 mobile espionage campaign involving compromised websites, a Google Chrome vulnerability and a Qualcomm Adreno GPU driver flaw. The attackers reportedly deployed malware capable of stealing browser cookies, saved credentials and Wi-Fi passwords from affected Android devices.
A sophisticated cyberespionage campaign reportedly exploited vulnerabilities in Google Chrome and Qualcomm’s Adreno graphics driver to compromise Android smartphones, according to research published by cybersecurity company Sekoia.
The campaign, attributed by Sekoia to the Russia-linked threat group APT29 with moderate-to-high confidence, used compromised websites to expose mobile users to malicious content.
Researchers say the activity targeted users across the United States and Europe, with particular attention directed toward Ukraine.
On Android, the attackers reportedly combined two vulnerabilities to execute malicious code and escape Chrome’s security sandbox. Following successful exploitation, malware identified as AndroSnitch could collect sensitive information from affected devices.
Sekoia also described separate attacks against iPhones, including exploit chains targeting older iOS versions.
The findings highlight how attackers can use apparently legitimate websites as delivery channels for sophisticated mobile exploits, although the report does not establish that every device visiting an affected website was compromised.
APT29 Campaign Used Compromised Websites to Target Mobile Users
Sekoia’s investigation describes a large-scale watering hole campaign targeting mobile device users.
A watering hole attack typically involves compromising websites that a particular audience is likely to visit.
Instead of sending malicious files directly to each target, attackers place harmful content on websites that users may already trust.
When an intended victim visits an affected website, the attacker-controlled content can attempt to exploit vulnerabilities in the visitor’s browser or device.
According to Sekoia, the investigation began after researchers discovered a malicious JavaScript inclusion associated with a Ukrainian gas production company’s website.
The injected code reportedly led to an attacker-controlled server responsible for delivering exploit content.
The researchers subsequently identified additional methods used to distribute malicious material, including fraudulent websites and the compromise of a web analytics service.
Sekoia attributed the broader campaign to APT29, a cyberespionage group widely associated by security researchers and Western governments with Russia’s Foreign Intelligence Service, known as the SVR.
However, attribution in cybersecurity investigations is an assessment based on available evidence, not an independently established identification of every individual involved.
Google Chrome Vulnerability CVE-2026-3910 Used in Android Attacks
According to Sekoia, the Android attack chain involved two security vulnerabilities.
The first, tracked as CVE-2026-3910, reportedly allowed the attackers to execute malicious code within Google Chrome.
Chrome is widely used on Android smartphones, making browser vulnerabilities relevant to a large number of devices.
However, exploiting a browser vulnerability does not necessarily provide unrestricted access to the entire operating system.
Modern browsers use security mechanisms, including sandboxing, intended to limit the consequences of malicious code execution.
Sekoia says the attackers combined the Chrome vulnerability with a second flaw affecting Qualcomm’s graphics driver to overcome that restriction.
Which Chrome Versions Were Reportedly Targeted?
The researchers identified Chrome versions 139 through 145 as part of the exploit’s targeting criteria, with version 143 excluded.
This is an important distinction because the supplied report does not claim that every Chrome version within that numerical range was targeted identically.
It also does not establish that all installations of those versions were vulnerable regardless of operating system, hardware, security updates or device configuration.
Users should consult current Google security advisories for confirmed affected builds and relevant fixes.
A version number alone is not sufficient to determine whether an individual device was successfully compromised.
Qualcomm Adreno GPU Vulnerability Helped Attackers Escape Chrome’s Sandbox
The second vulnerability involved in the reported Android attack is CVE-2025-27038.
According to Sekoia, this flaw affected Qualcomm’s Adreno GPU driver and was used to escape Chrome’s sandbox.
A browser sandbox is intended to restrict what browser processes can access on a device.
Escaping that protected environment can allow attackers to reach resources that would otherwise be isolated from browser content.
Qualcomm’s Adreno graphics technology is used in numerous Snapdragon-powered smartphones.
Consequently, some devices using affected Qualcomm hardware and vulnerable driver builds could potentially have been exposed to the attack.
However, the presence of a Snapdragon chipset does not automatically mean a smartphone was vulnerable.
The actual risk depends on factors such as the specific GPU, driver version, installed security patches and other platform protections.
The supplied information does not identify a complete list of affected handset models or Android operating system versions.
Chrome and Qualcomm Vulnerabilities Reported by Sekoia
| Vulnerability | Reported role |
|---|---|
| CVE-2026-3910 | Code execution within Google Chrome |
| CVE-2025-27038 | Qualcomm Adreno GPU driver flaw reportedly used for sandbox escape |
| Attack method | Malicious content delivered through compromised websites |
| Target platform | Affected Android devices |
| Reported Chrome targeting | Versions 139–145, excluding 143 |
| Post-exploitation malware | AndroSnitch |
These are findings attributed to Sekoia. Confirmed patch status and exact affected configurations should be checked against Google and Qualcomm security bulletins.
AndroSnitch Malware Reportedly Stole Sensitive Android Data
After compromising an Android device, the attackers reportedly deployed malware identified by Sekoia as AndroSnitch.
According to the researchers, the malware was designed to collect sensitive information that could be valuable for surveillance or account access.
The reported targets included Chrome cookies, saved login information, browsing history and Wi-Fi configuration data.
In some circumstances, stolen browser cookies can be particularly sensitive.
Session cookies are used by websites to maintain an authenticated user’s session.
If an attacker obtains a valid session cookie, they may be able to impersonate the user on an affected service without immediately knowing the account password.
Whether this works depends on the service’s security measures, session restrictions and the validity of the stolen data.
Saved login information could also expose additional accounts, while browser history may reveal details about a user’s activities and interests.
Access to Wi-Fi configuration files could expose stored network information, including credentials where accessible.
The supplied report does not establish the number of devices infected with AndroSnitch or the total volume of data successfully stolen.
Android Exploit Reportedly Avoided Samsung Galaxy S25 Ultra
Sekoia also identified an unusual device-specific condition in the Android exploit.
According to the report, the attack contained a mechanism that stopped execution when it detected a Samsung Galaxy S25 Ultra.
The reason for this behaviour was not established in the supplied information.
It could relate to the attackers’ targeting decisions or technical considerations, but there is insufficient evidence here to identify the precise explanation.
Importantly, the reported behaviour should not be interpreted as proof that the Galaxy S25 Ultra is immune to browser-based exploits or other malware.
Sekoia did not identify additional smartphone models or Android versions that were deliberately excluded from the campaign.
Users should continue installing available security updates regardless of their device model.
Attackers Used Fake Websites and a Compromised Analytics Service
The campaign reportedly involved several methods for exposing users to malicious content.
Sekoia says the attackers injected harmful JavaScript into legitimate websites and created fraudulent copies of existing websites.
Researchers also identified the compromise of a Ukrainian web analytics service used by numerous websites.
Because web analytics scripts are often loaded automatically by participating websites, a compromised third-party service can create an opportunity for attackers to reach visitors across multiple sites.
The supplied report states that the analytics service was exploited between August 27 and September 3, although the exact year of that interval should be confirmed directly from the research timeline before publication.
The campaign reportedly included a fraudulent website imitating America250 and another resembling a luxury hotel in London.
These examples illustrate why the apparent identity or professional appearance of a website cannot, by itself, establish that every resource loaded by the site is safe.
A legitimate website can also become an attack delivery channel if its content or third-party scripts are compromised.
iPhone Users Were Targeted Through Separate Exploit Chains
Although the Android attack involved Chrome and Qualcomm vulnerabilities, Sekoia says iPhone users were also targeted through other techniques.
The researchers described one exploit chain reportedly designed to steal browser cookies from devices running iOS 16 through iOS 17.4.
Another attack reportedly used an exploit identified as DarkSword against devices running iOS 18.5.
According to the supplied findings, the latter attack could expose sensitive information, including messages, photographs and passwords.
These iOS attacks should not be confused with the Qualcomm Adreno vulnerability involved in the Android attack chain.
They used separate exploit techniques and affected different software environments.
The presence of older iOS versions in the report also does not establish that all devices running those versions were compromised.
Actual exploitation depends on the applicable vulnerabilities, device configuration and whether the user encountered malicious content.
APT29 Android vs iPhone Attack Comparison
| Category | Android | iPhone |
|---|---|---|
| Reported attack method | Compromised websites and exploit chains | Separate browser and operating-system exploit chains |
| Browser vulnerability | CVE-2026-3910 | Different vulnerabilities reported |
| Additional exploit | Qualcomm Adreno CVE-2025-27038 | DarkSword mentioned in one chain |
| Reported software targets | Chrome 139–145, excluding 143 | iOS 16–17.4 and iOS 18.5 in separate attacks |
| Malware or payload | AndroSnitch | Separate reported payloads |
| Data reportedly targeted | Cookies, login information, browser history, Wi-Fi details | Cookies, messages, photos and passwords |
| Confirmed total victims | Not specified | Not specified |
This comparison is based on Sekoia’s reported findings and does not provide a complete vulnerability assessment for either operating system.
Why the DarkSword Reference Matters
Sekoia’s findings also point to the reported use of DarkSword, an exploit associated with attacks against iOS devices.
The researchers highlighted concerns about the wider reuse of sophisticated exploit capabilities, including tools associated with commercial surveillance activity.
Such reuse can make advanced attack techniques accessible to a broader range of threat actors.
However, identifying a particular exploit toolkit does not, on its own, establish who originally developed it or whether every campaign using it has the same operator.
These distinctions matter when evaluating cyberespionage attribution.
How Android and iPhone Users Can Reduce Their Exposure
The reported campaign demonstrates why browser and operating system security updates are particularly important.
Some mobile attacks can exploit vulnerabilities through malicious web content, potentially reducing the need for victims to install a suspicious application manually.
Users can take several practical precautions.
1. Install the Latest Security Updates
Keep Android or iOS updated with the latest security releases available for the device.
On Android, also check the manufacturer’s system update and Google Play system update options.
Devices that no longer receive security patches may face additional risks from known vulnerabilities.
2. Update Google Chrome
Android users should keep Chrome updated through the Google Play Store.
Browser updates can include important security fixes, although users should consult Google’s security notes to confirm which vulnerabilities have been addressed.
3. Avoid Suspicious Links and Imitation Websites
Be cautious when opening unexpected links, particularly those received through unsolicited messages or unfamiliar sources.
Check website addresses carefully.
However, the campaign also involved compromised legitimate websites, so avoiding obvious scams alone would not eliminate the entire risk.
4. Review Important Account Sessions
Users who suspect account compromise should review active sessions and connected devices for important accounts.
Where appropriate, sign out of unfamiliar sessions and use the service’s account security controls to revoke existing sessions.
Changing a password alone may not invalidate every stolen session cookie.
5. Enable Strong Account Protection
Use unique passwords and enable multi-factor authentication where available.
Passkeys and phishing-resistant authentication methods can provide stronger protection against some forms of account compromise.
However, no authentication method should be described as a complete defence against device-level exploitation.
6. Check Device Manufacturer Advisories
For Android smartphones using Qualcomm hardware, security patches may depend on both the chipset vendor and the device manufacturer.
Users should consult official security update information for their specific handset rather than relying solely on the chipset name.
What Should Users Do If They Suspect Their Device Was Compromised?
The report does not establish a simple visual symptom that reliably identifies an AndroSnitch infection.
A device operating normally should not be assumed secure, and unusual battery use or overheating is not sufficient proof of this particular malware.
People with credible reasons to suspect compromise should prioritise installing updates and securing important accounts from a separate trusted device.
They should also review account activity, revoke unfamiliar sessions and consider obtaining assistance from a qualified security professional.
Individuals facing elevated targeting risks, such as journalists, diplomats or people involved in sensitive work, may benefit from specialist incident-response guidance.
A factory reset should not be presented as a universal guarantee of remediation without understanding the specific compromise.
What the Sekoia Report Means for Mobile Security
The investigation highlights several important characteristics of modern mobile cyberespionage.
First, attackers may combine vulnerabilities across different software components to obtain access that a single browser flaw would not provide.
Second, trusted websites and third-party scripts can become attack delivery channels when compromised.
Third, attackers may target both Android and iOS users through separate exploit chains within a broader campaign.
The reported theft of browser cookies and saved credentials also demonstrates why protecting online accounts requires more than choosing strong passwords.
The central security concern is the reported combination of browser exploitation, sandbox escape and credential theft through malicious web content.
At the same time, the available evidence does not establish that all Android smartphones using Snapdragon processors were vulnerable or that a widespread compromise occurred across the entire Android user base.
The precise scope of the campaign and the number of successful infections remain important unanswered questions.
TechLayers will continue following mobile security research and official vulnerability disclosures.
Have a story tip or feedback? Contact [email protected].
© TechLayers. Original editorial content.
