A campaign associated by security firm Sekoia with APT29 compromised targeted Android phones simply by loading malicious webpages, according to the researchers. The attack chain required no app installation or user-granted permissions, and could deploy the AndroSnitch malware to extract browser and Wi-Fi data from affected devices.
The operation combined CVE-2026-3910, a Google Chrome vulnerability used for code execution, with CVE-2025-27038 in Qualcomm's Adreno GPU driver. Exploiting the driver flaw allowed attackers to break beyond the browser's protections and gain deeper access to the device. The Android chain targeted Snapdragon-powered phones running Chrome versions 139 through 145, except version 143; the reason for that exclusion is unknown.
After compromise, AndroSnitch was reported to collect the following information:
- Chrome cookies, which could potentially let attackers access accounts without entering a password again.
- Saved Chrome login credentials.
- Chrome browsing history.
- Saved Wi-Fi network details and passwords.
The attackers used both compromised legitimate websites and fraudulent pages, including copies of the America250 website and a London hotel site. Between August 27 and September 3, 2026, they also compromised a Ukrainian web analytics service used by thousands of websites. A script profiled a visitor's device and selected an appropriate exploit. The Android attack was configured to stop if it detected a Samsung Galaxy S25 Ultra.
Sekoia links the activity to APT29, a group associated with Russia's foreign intelligence services, and says the apparent targets included diplomats and people connected to the war in Ukraine. iPhones were also targeted: operations against iOS 16 through iOS 17.4 sought cookies, while an exploit called DarkSword could extract messages, photos and passwords from devices running iOS 18.5.
Both vulnerabilities had been patched before the attacks, according to the report. Users should update Chrome to a version newer than 145 and install the latest Android security updates, including Qualcomm driver fixes. The unexplained omission of Chrome 143 remains one of the campaign's unresolved technical details.
