# APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

> **Open Intelligence Dossier** · First detected: 2026-11-04 22:40 UTC · Category: Technology

## Executive Summary
Hackers linked to Russia's Foreign Intelligence Service are hijacking web analytics scripts to deploy mobile exploits on iOS and Android devices.

## Intelligence Brief
A sophisticated cyber operation linked to the Russian Foreign Intelligence Service, identified as APT29, has targeted mobile users by hijacking web analytics scripts. According to reports from NewsCord and Ars Technica, these hackers injected malicious JavaScript into legitimate web analytics tools to deliver exploits to both iPhone and Android devices. The primary goal of this injection is the theft of sensitive data from these mobile platforms. The attack vector utilizes a method of compromising the scripts that websites use to track visitor data, effectively turning a standard business tool into a delivery mechanism for malware. Coverage from GBHackers News emphasizes that the attackers created fake websites mimicking entities in the United States and the United Kingdom. These fraudulent sites were designed to lure visitors who would then be targeted with mobile exploits upon visiting.


NewsCord further notes that this specific campaign has been analyzed across eight different outlets, highlighting the coordinated nature of the threat. The emphasis across these reports is on the specific targeting of mobile operating systems, iOS and Android, demonstrating a capability to bypass standard mobile security measures via browser-based JavaScript injections. This activity is significant because it leverages the trust placed in third-party web analytics scripts, which are common across millions of websites. By poisoning these scripts, the actors can reach a wide array of victims without needing to compromise the primary server of every target website. The involvement of the Russian Foreign Intelligence Service indicates a state-sponsored level of resource and intent. The use of fake US and UK sites suggests a strategic focus on Western targets, utilizing social engineering to drive traffic toward the exploited scripts to facilitate the infection of mobile phones.


Future monitoring will focus on the specific flaws within iOS and Android that were exploited to infect the phones, as noted by Ars Technica. Because the coverage identifies the use of fake government or organizational websites from the US and UK, observers are watching for additional fraudulent domains being registered. There is a continued need to track how the Russian Foreign Intelligence Service modifies its JavaScript injection techniques to evade detection by security software. Current reports establish the mechanism of the attack, but the full scope of the stolen data remains a point of ongoing analysis.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| NewsCord | Russia’s Foreign Intelligence Service Hackers Inject JavaScript To Steal iPhone And Android Data: 8 outlets compared | [Source Link](https://news.google.com/rss/articles/CBMi6gFBVV95cUxQV3JaRkxJRnJsTzFHTVY1eWJHY2tmZ3VxaEF3LXdQUWl1TGlzLVUwWDNZSFotVFJVaVlUd1owdnQ4X2ZwWXZZTEtPZTNJR2s3ZURqQU1mYWdZRXlyaC1PVV9OWjdna19EdXVFVlZfdW8xUUVpOFpaR2dUNDBic2Y1RzZLNnNfRm43Z2puLVBrZ0xCQjRVMWFpQkFoSFNjRzhISnN0X0p0S3Fqa0QxNHI3Y0FGc2M3bGxEdkVvam1WaE9FamdoTWhsdGVXZ1VpZHZELVpjV1RIbmdfODVHZm5DQ05qaVI0bmJRMXc?oc=5) |
| GBHackers News | Russian Hackers Create Fake US and UK Websites to Target Visitors With Mobile Exploits | [Source Link](https://news.google.com/rss/articles/CBMiWkFVX3lxTE0taUNGaFNqZmNmMnk0UFR6TnZhWm1id0xFZWtmeFlwTDRNLVlvaWJjUVQxT3JKNFFmQ3hMQ0RBeEpfeXk1MFJQN2RZZFZfeG1zQ1BGMlVfckJpd9IBX0FVX3lxTE9Cci1DSzJGTF9TX3dZLV9aOENOTVNUMkRCSmNiRldOSG93TEpFU09pN0hSS2VkLVZ4M1d4SkRBTEdhNkJyVHlZYUVWc0lvVno0d1FHZDBiN1QteC1Ud0tz?oc=5) |
| Ars Technica | Hackers exploited iOS and Android flaws to infect phones | [Source Link](https://news.google.com/rss/articles/CBMinwFBVV95cUxPXzZsblRBRUFaSkwzb0hHVUtkd3cxMk9HNjlQa0ZSUmZQcnlhTHFrUU9vRWtVSW5yTkpVSU9CdTlDams4bzdRNEgxTFFteVRBdEs0OE1FX0RteE5QVWZmczhnUXdUTURUNkNRRXRubW9iQjhCTG9IdE91N1BZTm02N2hLeUlpUGU1OHNpMkxIUHBCSVhRaVBvcTRNWEgwd1U?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-11-04/apt29-linked-hackers-hijack-web-analytics-script-to-deliver-ios-and-android*