Hackers exploited iOS and Android flaws to infect phones

A suspected Russian Foreign Intelligence Service operation used compromised and impersonated websites to target visitors’ iPhones and Android phones. Researchers assessed with moderate-to-high confidence that the group was linked to the Kremlin, citing the targets and similarities to earlier activity attributed to APT29. Targets included a site marking the United States’ 250th anniversary, a London luxury hotel frequented by prominent visitors, Ukrainian websites, and a Ukrainian analytics service used by thousands of sites. The attackers may have sought diplomatic and other high-profile targets, including through spear-phishing campaigns.

The attacks began with JavaScript injected into website traffic, which profiled visitors’ devices before selecting a platform-specific exploit chain. The group used three delivery routes: tampering with traffic from legitimate sites, creating proxy domains that copied real sites, and compromising the analytics service’s supply chain. The payloads attempted to steal browser cookies and, in some cases, Wi-Fi passwords and extensive device data. One exploit chain was DarkSword, previously used by multiple threat actors; researchers identified two other, unnamed chains. All exploited flaws had already been patched, so the attacks worked only against phones running outdated iOS or Android software. The exploit chains required no action from victims once they visited a compromised page, making timely operating-system updates a key defense.