Hackers working for Russia's APT29 group spent months breaking into Android and iOS phones through websites their victims trusted, according to new research from cybersecurity firm Sekoia. The attacks ran from June to September 2025 and used flaws in Google Chrome and in Qualcomm's Adreno graphics driver to steal data from people who simply visited a booby-trapped web page.

What Sekoia found

The campaign used watering-hole attacks: the hackers compromised real websites and planted malicious code on them, so anyone who visited the site was attacked without clicking anything suspicious. The sites were chosen to match the victims' interests — a fake cloud service, a crypto trading platform, a government job board and a software download page were among the lures.

Sekoia first picked up the trail on August 19, 2025, when it spotted a crash in Google Chrome's V8 JavaScript engine. Digging into that crash led the team to a full exploit chain — a sequence of flaws used one after another to break out of the browser and take control of the phone.

The payloads collected contacts, location data, lists of installed apps, SMS messages and device details, and sent them back to servers run by the hackers.

The flaws that opened the door

On Android, the chain started with a flaw in Chrome's V8 engine, CVE-2025-2783, which let the attackers escape the browser's sandbox. A second Chrome flaw, CVE-2025-2856, a type confusion bug in V8's Mojo component, gave them a way to run code on the device. The final step used a flaw in Qualcomm's Adreno GPU driver, CVE-2025-24816, to gain the deeper access needed to read personal data.

That driver flaw affects a long list of Snapdragon chips, including the 680 and 685, the 865 and 865+, the 888 and 888+, the 8 Gen 1, 2 and 3, the 8s Gen 3 and 4, and the 8 Elite Gen 5.

Google moved fast once the flaws were reported: CVE-2025-2783 was reported on March 20, 2025 and patched on March 25 in Chrome 134.0.6998.88/89, while CVE-2025-2856 was reported on March 27 and fixed in April. The Adreno flaw was fixed in Qualcomm's October 2025 security bulletin.

Who was targeted

Sekoia says the campaign focused on people in the United States, the United Kingdom, France and Spain, picked for their roles rather than at random. The researchers link the effort to APT29 — also known as Midnight Blizzard or Cozy Bear — and note that Google's own threat team has tied related activity to the same group.

Google said in October 2025 that the average time between a flaw being found and being used in real attacks had fallen to about 35 days. The Chrome flaws in this campaign fit that pattern: both were reported by researchers, patched quickly, and still found their way into attacks within weeks.

How to protect your phone

Update Chrome to version 141.0.7390.122 on Android, or 141.0.7390.119 on iOS, and install the latest Android security patch, which carries the Adreno driver fix. Turn on automatic updates for your browser and your phone's system software so you do not have to remember.

Beyond updates, the usual habits still help: be wary of links in messages and emails, and avoid downloading apps from outside the official stores. If you use a phone for work that involves sensitive information, treat a browser update prompt as urgent rather than something to put off.

Read the full story on Rohan Tech Official.