Security researchers at Sekoia have identified a sophisticated mobile hacking campaign that compromised Android and iPhone users through hijacked and fake websites. The attack on Android devices required no action from the victim. Simply opening an infected page in an outdated version of Chrome was sufficient for attackers to gain access.
Chrome and Snapdragon Vulnerabilities Exploited
The Android attack unfolded in stages. First, it utilized a Chrome flaw tracked as CVE-2026-3910 to execute code within the browser environment. The attackers then exploited CVE-2025-27038, a bug in Qualcomm’s Adreno GPU driver, to escape Chrome’s sandbox and gain deeper access to the phone. Since Adreno graphics processors are integrated into Snapdragon chips, phones powered by Qualcomm silicon were the primary targets.
The exploit specifically targeted Chrome versions 139 through 145. It notably skipped version 143, a detail Sekoia attributes to unclear reasons. Once a device was compromised, the attackers deployed malware they named AndroSnitch. This malicious software copied Chrome’s cookies, saved login data, and browsing history. It also stole the phone’s saved Wi-Fi configuration file, which contains passwords for previously connected networks.
Stolen cookies are particularly valuable to attackers because they allow unauthorized access to accounts that are already signed in. Interestingly, the Android exploit was programmed to stop if it detected a Samsung Galaxy S25 Ultra. Sekoia did not identify other specific phone models or Android versions that were targeted.
APT29 Linked to Diplomatic and Geopolitical Targets
The hacking campaign reached victims through multiple vectors. Attackers injected malicious code into legitimate websites, created lookalike copies of real sites, and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. The fake sites included a copy of the America250 website and one mimicking a luxury London hotel near UK government offices.
A script on these pages profiled each visitor’s device and served the matching exploit. Sekoia links this campaign to APT29, a hacking group tied to Russia’s foreign intelligence service. The targets suggest the group focused on diplomats and individuals connected to the war in Ukraine rather than ordinary users.
iPhones were also targeted in this campaign. One exploit chain stole cookies on iOS 16 through 17.4. Another exploit called DarkSword grabbed messages, photos, and passwords from devices running iOS 18.5.
The good news is that every flaw used in this hacking campaign had already been patched before the attacks began. To ensure protection, users should update Chrome from the Play Store and verify they are on a version newer than 145. This can be checked by opening Chrome’s menu and navigating to Settings About Chrome. Installing the latest security update for your phone is also recommended, as fixes for Qualcomm’s GPU drivers are delivered through monthly patches.
Source: Android Authority
