APT29 Mobile Watering Holes, Zyxel Zero-Day, and Device-Code Phishing

Russian state-linked APT29 is running active watering hole attacks through compromised legitimate websites, including a UK hotel. The campaign targets mobile devices via silent JavaScript exploits requiring no user interaction beyond visiting the site. Separately, Zyxel has patched a zero-day in its SMB-focused GS1900 network switches after nearly 1,000 devices were compromised worldwide, with attackers stealing configuration files and credentials. The SkyW4lker phishing kit continues to bypass multi-factor authentication on Microsoft 365 accounts by abusing legitimate device-code authentication flows, with over 600 analyses recorded between June and October 2026. All three incidents exploit the gap between available patches or configurations and actual deployment. UK small businesses are advised to verify mobile device patch status, check for vulnerable Zyxel switches, and restrict device-code flow authentication in Microsoft 365 tenants. Additional intelligence covers AI-driven attack automation by VAPOR PANDA, North Korean financial crime, and an active XLoader campaign targeting business email.

Chapters

• Introduction Overview of three current threat scenarios affecting UK small businesses, with focus on APT29’s use of legitimate websites as attack infrastructure.
• APT29 Mobile Watering Holes Analysis of Russian Foreign Intelligence Service-linked group’s watering hole campaign targeting mobile devices through compromised websites including a UK hotel, exploiting n-day vulnerabilities spanning iOS and Android across 2024-2026.
• Call to Action Listener engagement prompt.
• Zyxel GS1900 Zero-Day Coverage of zero-day vulnerabilities in Zyxel’s SMB-targeted network switches, with nearly 1,000 devices compromised before patches were available, resulting in credential and configuration theft.
• SkyW4lker Device-Code Phishing Examination of phishing kit abusing Microsoft’s legitimate device-code authentication flow to bypass multi-factor authentication, with 618 sandbox analyses recorded June-October 2026 and rising activity in Europe.
• Wider Intelligence Picture Brief notes on AI-driven attack automation by VAPOR PANDA, North Korean state-sponsored financial crime totalling $6.34 billion, and active XLoader campaign targeting business email.
• Closing Summary Synthesis of common themes across the day’s threats and three actionable questions for UK SMBs regarding mobile device patching, network infrastructure firmware, and Microsoft 365 authentication configuration.

Links

• https://www.sekoia.io/en/apt29-mobile-watering-holes/
• https://www.bleepingcomputer.com/news/security/zyxel-patches-zero-day-exploited-in-attacks-on-gs1900-switches/
• https://any.run/cybersecurity-blog/skyw4lker-phishing-kit/
• https://www.ncsc.gov.uk/guidance/token-theft