A high-profile hacking group, linked to Russia’s APT29 espionage collective, has been using a sneaky tactic to compromise both iOS and Android devices. By hijacking web analytics scripts, these hackers are able to slip malicious code onto vulnerable websites, which is then downloaded onto unsuspecting users’ mobile phones.
The web analytics script in question is designed to track website traffic and user behavior. However, the APT29-linked hackers have repurposed this script as a way to inject malware onto devices that visit affected sites. This malware is capable of exploiting security vulnerabilities on both iOS and Android platforms, allowing the attackers to gain unauthorized access to sensitive data.
This tactic highlights the importance of understanding how web analytics scripts work – or rather, don’t work as intended. These scripts typically rely on JavaScript code being executed within a user’s browser. When an affected website is visited, the script loads onto the device and sends information about browsing habits back to its creators. In this case, however, the attackers have added their own malicious payload, allowing them to compromise devices without ever needing direct access.
The web analytics script’s reliance on JavaScript makes it a prime target for exploitation. Most modern websites rely on JavaScript to create interactive elements and enhance user experience – but also introduce potential security risks. The APT29-linked hackers are exploiting these vulnerabilities by injecting their own malicious code onto vulnerable sites, making them accessible to visitors’ devices.
The impact of this campaign is significant, given the sheer volume of devices affected. With web analytics scripts being used on thousands of websites worldwide, it’s likely that millions of users have unknowingly downloaded malware onto their mobile phones. This poses a substantial threat to sensitive information, such as login credentials and personal data.
As this story demonstrates, even seemingly innocuous scripts can be repurposed for malicious purposes. With the increasingly blurred lines between legitimate web analytics and cyber attacks, it’s crucial that website owners and users alike are vigilant about potential security risks. To stay safe online, we recommend exercising caution when visiting unfamiliar websites – especially those that require sensitive information.
Source: The Hacker News — 2026-11-04