The dangerous page looked ordinary. The phone was behind on patches.

Sekoia reports a campaign that placed JavaScript on compromised legitimate sites, used lookalike domains and altered a Ukrainian analytics service loaded by other websites. The script profiled a visitor's phone and browser, then directed a vulnerable device to an iOS or Android exploit chain. Sekoia traced the analytics compromise to a week between 27 August and 3 September and says it reached many sites that used the tracker.

The payloads sought browser data, cookies and other device information. Sekoia assesses with moderate to high confidence that the operation was linked to APT29, based on infrastructure and operating patterns. That is an attribution assessment, not a confirmed identity for every affected website or visitor.

1. 1

   Find lagging mobile devices. Review operating-system and browser patch levels, prioritizing users who handle sensitive access or travel. Include devices outside standard management that reach company services.

2. 2

   Review third-party web scripts. Inventory analytics and other scripts on high-value sites. Keep records of changes to delivered script content and investigate unexpected external loaders.

3. 3

   Investigate exposed sessions. Where a user may have visited an affected page on an unpatched device, assess session and credential exposure using the researcher's indicators and your own sign-in logs.

Calling this “zero click” can obscure the entry point: a person still visited a compromised or impersonating website. Once the page loaded, the exploit chain required no further interaction. That makes mobile patch coverage and control of third-party scripts more useful defenses than telling users to avoid suspicious links alone.