On a morning when several security outlets converged on the same account, a quiet but unsettling pattern came into view: hackers associated with APT29, a name long tied to Russian state-backed intelligence work, reportedly hijacked a small web analytics script and used it to deliver attacks to phones running iOS and Android. The reports, from Ars Technica, The Hacker News, BleepingComputer, SC Media and Gulf News, rest on attribution that remains the outlets' own, not independently proven. What stands out is how ordinary the path was: a counting tool that quietly runs on countless pages became
APT29-Linked Hackers Reportedly Hijacked a Web Analytics Script to Deliver iOS and Android Exploits
The fixes exist, and installing them is what closes the door.
Mark
Why does a web analytics script matter so much here?
Mimi
Because it's code that many pages load without a second thought. If attackers control it, every site using it becomes a delivery route.
Mark
And the exploits themselves were new?
Mimi
The reporting says n-day, meaning flaws already known and patched. The danger is in devices that haven't updated.
Luke
Let me flag something. The APT29 link is what outlets are reporting. What we have doesn't show who established it or on what evidence.
Mark
So how firmly can we say it's Russian state-backed?
Luke
Not firmly. SC Media says so in its headline, but the underlying proof isn't in front of us. Treat it as attributed.
Mimi
Same with scale. There's no count of infected phones or affected websites.
Mark
What would 'zero-click' mean for a reader?
Mimi
That a user may not have to tap anything. Visiting a compromised page could be enough, according to BleepingComputer's headline.
Luke
Though we don't know which flaws, which OS versions, or how many people were actually hit. Those are open questions.
Mark
So what's the sensible takeaway?
Mimi
Update your phone. The fixes reportedly already exist.
Le Pouls
- A tiny analytics script, the kind that quietly counts visitors on ordinary websites, was reportedly hijacked and turned into a delivery route for attacks.
- Attackers linked by outlets to APT29, a long-known Russian state-backed group, are said to have infected both iPhones and Android phones without any click from the victim.
- The exploits used were n-day flaws, already patched by vendors, so the attack leaned on devices that had not yet taken the available updates.
- The attribution and the technical details still rest on the reporting outlets; the affected sites, the number of infected devices and the attackers' follow-up actions remain unnamed.
- Next moves to watch are vendor confirmation of the APT29 link and whether site operators and phone users receive clear patch guidance.
On a morning when several security outlets converged on the same account, a quiet but unsettling pattern came into view: hackers associated with APT29, a name long tied to Russian state-backed intelligence work, reportedly hijacked a small web analytics script and used it to deliver attacks to phones running iOS and Android. The reports, from Ars Technica, The Hacker News, BleepingComputer, SC Media and Gulf News, rest on attribution that remains the outlets' own, not independently proven. What stands out is how ordinary the path was: a counting tool that quietly runs on countless pages became the doorway, and the flaws used were ones already repaired, a reminder that the gap between a fix existing and a fix being installed is where danger often lives.
This morning several security outlets, including Ars Technica, The Hacker News, BleepingComputer, SC Media and Gulf News, are reporting the same troubling story. Hackers linked to APT29, a group long associated with Russian state-backed hacking, reportedly took over a web analytics script and used it to push exploits at iPhone and Android users who visited affected sites.
The method is what makes the story stand out. Analytics scripts run quietly on any page that includes them, so tampering with one turns many ordinary websites into a delivery route. According to the reports, the attacks were zero-click, requiring no action from the victim, and used n-day exploits: flaws already known and patched by the vendors. That means the campaign worked against devices that had not yet installed fixes that already existed.
Much remains unclear. The reporting does not name the compromised sites, the specific vulnerabilities, the number of victims, or the dates. The APT29 attribution comes through the outlets' reporting and has not been independently verified in what is available here. SC Media's description of a cyberespionage campaign suggests intelligence gathering, though this is not confirmed.
What comes next is whether the underlying security researchers confirm the attribution, and whether guidance reaches site operators and phone users. For now, the practical lesson is simple: the fixes exist, and installing available updates is what closes the door.
A headline cluster is what we have this morning, and it points in one direction. Several security outlets, among them Ars Technica, The Hacker News, BleepingComputer, SC Media and Gulf News, are running reports that hackers linked to APT29 hijacked a web analytics script and used it to push exploits at iPhone and Android users.
APT29 is the label long associated with Russian state-backed hacking. SC Media frames the activity as a Russian state-backed mobile cyberespionage campaign. The attribution comes through the outlets' reporting. The material at hand does not show who made the link or what evidence supports it, so it is best read as reported rather than proven.
The delivery method is the center of the story. According to the headlines, the attackers took over a web analytics script, the kind of small piece of code that websites load to count visitors. Because that script runs on whatever pages include it, tampering with it turns ordinary sites into a way to reach visitors. Gulf News describes the result as iPhone and Android users being targeted through compromised websites.
BleepingComputer's headline describes the attacks as zero-click and says they relied on n-day exploits. An n-day exploit targets a flaw that is already known and, in most cases, already patched by the vendor. That distinction matters. The campaign, as reported, did not depend on secret, unpatched vulnerabilities. It depended on devices that had not yet received fixes that already existed, which leaves anyone behind on updates exposed.
The headlines say the attacks hit both iOS and Android, so neither platform is singled out. Ars Technica puts it plainly: hackers exploited flaws in both operating systems to infect phones.
Much is missing from what is available here. The material does not name the compromised websites, the specific vulnerabilities, the number of infected devices, the victims, or the dates of the activity. It also does not say what the attackers did once a phone was infected, though SC Media's cyberespionage label suggests intelligence gathering rather than financial crime. Overall confidence in the details is moderate.
What to watch next is whether the security vendors behind the underlying research confirm the APT29 attribution, and whether guidance reaches the operators of affected sites and the people who use the phones. For ordinary users the practical takeaway is already visible in the n-day detail: the fixes exist, and installing them is what closes the door.
Citations marquantes
Hackers use n-day exploits in zero-click attacks on iOS, Android devices.— BleepingComputer headline
Envie de l'histoire complète ?
Lire l'original sur Google News ↗
Technology