Suspected Russian SVR Campaign Targets Mobile Devices to Steal Login Cookies

Sekoia identified a large-scale watering hole campaign targeting outdated iOS and Android devices to steal browser authentication cookies and other sensitive data. Detected in mid-October 2026, the operation used compromised websites, lookalike and reverse-proxy phishing domains, and a compromised Ukrainian web analytics service from Plerdy. Sekoia attributed the activity with moderate to high confidence to Russia’s Foreign Intelligence Service, associated with APT29, Cozy Bear and Midnight Blizzard. Targeted websites included those associated with a Ukrainian gas producer, a U.S. chemical industry trade association, America250 and a Bulgarian military-related organization.

The attackers exploited known, already-patched vulnerabilities and prioritized intelligence collection rather than persistent access to devices. Stolen session cookies could enable access to corporate and cloud accounts without passwords or additional multifactor authentication challenges, while other collected data could support spear phishing and account takeovers. Sekoia investigated with CERT-UA and an unnamed partner and contacted 25 providers and hosting companies to request infrastructure takedowns. Organizations should prioritize mobile OS updates and revoke potentially exposed sessions, rather than rely on password resets alone.