APT29 Linked to Chrome and Qualcomm Exploits on Unpatched Android Phones
French security firm Sekoia says a watering-hole campaign it ties with moderate-to-high confidence to Russia-linked APT29 (also tracked as Midnight Blizzard or Cozy Bear) hit Android phones by chaining already-patched flaws in Chrome and Qualcomm’s Adreno GPU driver. Opening a compromised page in an outdated Chrome build was enough—no tap, install, or permission prompt.
How the Android chain worked
Sekoia’s Threat Detection & Research team spotted the operation in mid-October 2026. On Android, the delivery server served exploits only to Chrome versions 139 through 145, skipping 143 for reasons the researchers say remain unclear. The first stage used CVE-2026-3910, a Chrome V8 flaw patched in Chrome 146, to run code inside the browser sandbox. A second stage used CVE-2025-27038 in Qualcomm’s Adreno driver—fixed in Android’s August 2025 security bulletin—to break out of that sandbox on Snapdragon-powered phones.
The final payload, which Sekoia dubbed AndroSnitch, copied Chrome cookies, saved logins, and browsing history, plus the device’s saved Wi-Fi configuration. Stolen cookies matter because they can let an attacker reuse already-signed-in sessions. The chain stopped if it detected a Samsung Galaxy S25 Ultra (model SM-S938B). None of the payloads established persistence; a reboot ends the activity until the phone visits a booby-trapped page again.
How victims were reached
According to Sekoia, attackers used three delivery paths: JavaScript injected into legitimate sites (including a Ukrainian gas producer, a U.S. chemical industry trade association, and a Bulgarian military-related site), lookalike domains that reverse-proxied high-profile pages such as America250 and Raffles London at The OWO, and a one-week compromise of Ukrainian analytics service Plerdy from August 27 to September 3, 2026. That tracker ran on thousands of mostly Ukrainian sites, including defense-linked ones. A fingerprinting script profiled each visitor’s browser and device, then served a matching exploit chain with no further user action.
iPhones were in scope too. Separate chains stole Safari cookies on older iOS builds and, via a DarkSword-linked kit on iOS 18.5, harvested messaging apps, Keychain data, location, health info, and photos. Attribution rests on overlaps with a 2025 APT29 watering hole a partner tied to one compromised site, similarities Google’s Threat Analysis Group noted with a 2024 Mongolian-government campaign, and a victim focus centered on Ukraine and related high-value targets.
What to do
Every CVE in the campaign was patched before the attacks began. Sekoia’s line is blunt: a fully updated phone was safe. Android users should confirm Chrome is 146 or later via Settings → About Chrome and install the latest system security update so Qualcomm driver fixes land. Reporting from Android Authority, Help Net Security, and BleepingComputer tracks the same Sekoia findings.
Sources: Sekoia, Android Authority, Help Net Security, BleepingComputer