APT29 target unpatched mobile devices using patched exploit chains

A suspected Russian espionage group known as APT29 conducted a watering hole campaign targeting mobile devices using three previously patched exploit chains, according to Tech Insider. Sekoia's Threat Detection and Research team published its Poisoned Source report on November 4, 2026, detail findings from the campaign. BleepingComputer also reported on the security firm's assessment, which concluded with moderate to high confidence that the group compromised legitimate websites to serve the exploits. [1]

The watering hole campaign specifically targeted two iOS exploit chains and one Android exploit chain, Tech Insider reported. Devices running current software versions were not exposed to any of the three exploit chains used in the attacks. However, the hackers targeted older devices that were still running outdated software, specifically iOS 16.7, iOS 18.5, and Google Chrome versions 139 through 145. [1]

The APT29 group has previously been linked to high-profile cyber operations. A major cyberattack in 2020, suspected to have been committed by a group backed by the Russian government, compromised thousands of organizations globally, including multiple parts of the United States federal government. [2]

To mitigate the risk from this watering hole campaign, security teams should ensure end-user devices are updated to current operating system and browser versions. Devices running updated software were not vulnerable to the three exploit chains observed in the attacks. [1]