Sekoia says the SVR-linked group watered legitimate and spoofed websites and compromised Plerdy analytics to steal messages, passwords and photos from iPhones and Androids.
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
APT29 campaign hits iOS 16.7 18.5 and Android Chrome with patched n-day flaws via JavaScript injection and supply-chain compromise.
APT29 planted malicious scripts on real and cloned websites in the US, Ukraine and Europe to compromise outdated iPhones and Androids by stealing cookies and data.
APT29 deploys n-day exploits via watering-hole sites on iOS and Android devices with no user interaction.
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
Exposed Flowise honeypot shows attacker using AI agent for reconnaissance against other servers via prompt injection.
Sekoia’s emulated Flowise 2.2.8 captured credential queries and prompt injection, without proof of production theft.
Hackers exploited unpatched Danfoss fridge controllers, spoiling food at more than 400 European grocery stores.
Jordan detained ShinyHunters suspect Rey, who is reportedly helping the FBI identify other members.
New Exvicy MaaS uses compromised WordPress sites to deliver ClickFix lures mimicking Cloudflare Turnstile, assessed as a copycat of ErrTraffic.
North Korea's Contagious Interview campaign hit 30,000 devices and stole about $10.71 million in crypto.
Sekoia says the Exvicy ClickFix malware service reuses ErrTraffic code and delivers payloads via WordPress.
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views