Hackers exploited iOS and Android flaws to infect phones
Researchers say attackers possibly tied to Russia's Foreign Intelligence Service used already-patched iOS and Android vulnerabilities to target visitors of several websites. Among the spoofed sites was one marking the 250th anniversary of American independence.
Hackers possibly linked to the Kremlin tried to infect the smartphones of visitors to multiple websites by exploiting iOS and Android vulnerabilities that had already been patched, security researchers said on Wednesday. They assess with “moderate to high confidence” that the attackers belong to Russia's Foreign Intelligence Service.
How the attack worked
The attack began when an iPhone or Android user opened one of potentially hundreds of sites. JavaScript injected into the traffic first profiled the device. A payload tailored to the visiting platform then tried to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
The impersonated sites
One imitated site was america250.org, which belongs to a non-partisan group of lawmakers, business executives and at least one former Trump administration member. The attackers registered the domain america250[.]holiday and used it as a reverse proxy to the genuine site. The fake page served the real site's content with malicious JavaScript added.
Researchers at the security firm Sekoia said the attackers may have chosen the site because of its link to a high-profile national celebration, possibly using it as a pretext for invitation-themed spear-phishing campaigns.
A second site, theowo[.]club, mimicked the website of Raffles London at The OWO, a luxury hotel close to sensitive UK government institutions, including the Ministry of Defence and 10 Downing Street, the official residence and office of the British Prime Minister. Open source reporting indicates Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.
The attackers also targeted other sites, many of them linked to Russia's ongoing war against Ukraine.
