SlowMist's 23pds Warns APT29 Is Spreading iOS and Android Exploits

Mobile crypto users may face exposure from a campaign that uses compromised websites and hijacked web analytics scripts to deliver iOS and Android exploits, SlowMist Chief Information Security Officer 23pds warned.

23pds linked the operation to APT29 and described the group as related to Eastern Europe. The warning named DarkSword and AndroSnitch, saying the tools had begun being used in large-scale attacks. It also said ordinary websites and apps may carry backdoors, allowing malicious code to reach users through services that appear legitimate.

The warning describes two routes into everyday mobile browsing: compromised websites and hijacked scripts used for web analytics. It says regular sites or apps may carry backdoors, placing crypto users within the broader group of iOS and Android users potentially exposed. For crypto users, the described risk is at the device and browsing level: exposure could occur while using an ordinary site or app, not only a crypto service. 23pds urged users to install the latest operating system updates.