APT29 Conducts Watering Hole Attacks Targeting Mobile Users

According to a report from Dark Reading published on November 5, 2026, the Russian state-sponsored threat group APT29 has been conducting watering hole attacks targeting mobile users. The attack chain begins with the compromise of websites commonly visited by the intended victim demographic. Once a user accesses a compromised site, the server performs device fingerprinting to assess the mobile device's characteristics. Victims deemed "interesting" based on the fingerprinting data are then targeted for information harvesting. The exact number of affected users and the specific categories of data exfiltrated have not been fully specified in the available reporting. The campaign leverages the trust users place in legitimate websites, redirecting them to malicious infrastructure hosted on the compromised domains. Security experts note that the technique is consistent with previous APT29 operations attributed to Russian state interests. No specific software vulnerability or patch has been identified; the attack exploits user behavior and device configuration. Recommendations include keeping mobile operating systems and security applications up to date, avoiding interaction with suspicious websites, and monitoring devices for anomalous behavior indicative of compromise.