Hackers chained Chrome and Snapdragon GPU flaws to hit Android

What the malware took

The exploit targeted Chrome versions 139 through 145, skipping version 143 for reasons Sekoia calls unclear. On compromised phones, the attackers installed malware Sekoia names AndroSnitch. It copied Chrome cookies, saved logins and browsing history, plus the Wi-Fi configuration file holding passwords for saved networks. Stolen cookies are especially useful because they can open accounts where the victim is already signed in. The code was also written to stop if it detected a Samsung Galaxy S25 Ultra.

How victims were reached

Attackers injected malicious code into legitimate sites, built lookalike copies of real ones, and compromised a Ukrainian web analytics service used by thousands of mostly Ukrainian websites between August 27 and September 3. Fake pages included a copy of the America250 site and one imitating a luxury London hotel near UK government offices. A script profiled each visitor's device and served the matching exploit.

Sekoia links the campaign to APT29, a group tied to Russia's foreign intelligence service. The targeting points to diplomats and people connected to the war in Ukraine rather than ordinary users. iPhones were hit as well: one chain stole cookies on iOS 16 through 17.4, while the DarkSword exploit took messages, photos and passwords from devices on iOS 18.5.

How to protect yourself

Update Chrome through the Play Store and confirm you run a version newer than 145 via Settings > About Chrome. Also install your phone's latest security update, since fixes for Qualcomm's GPU drivers arrive through monthly Android patches.