APT29 ran zero-click smartphone espionage campaign against Ukraine, US and Europe

Sekoia says the SVR-linked group watered legitimate and spoofed websites and compromised Plerdy analytics to steal messages, passwords and photos from iPhones and Androids.

Sekoia attributed a zero-click espionage campaign targeting users in Ukraine, the US and Europe to APT29, a group believed to work for Russia's SVR. The attackers planted malicious code on legitimate websites, built spoofed versions of high-profile sites and compromised the Ukrainian analytics service Plerdy, whose tracking script reached hundreds of websites including Ukrainian military-linked ones. On iOS 18.5 devices they used the DarkSword surveillance toolkit to extract messages, emails, passwords, contacts, photos and location history; on Android they abused older Chrome flaws. All flaws used were previously patched, and the campaign would not work against fully updated devices. Sekoia has not established how many phones were compromised or how much data was obtained.

Unconfirmed: Sekoia did not determine how many devices were compromised or how much data was stolen, and could not say whether specific individuals were targeted.