What happened
Researchers said hackers possibly linked to the Kremlin exploited previously patched iOS and Android vulnerabilities to target visitors of multiple websites. The attackers were assessed with "moderate to high confidence" to be part of Russia's Foreign Intelligence Service.
How the attack worked
The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. JavaScript injected into the traffic profiled the device, and final payloads tailored to the platform attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
Impersonated sites
One of the impersonated sites was america250.org, which belongs to a non-partisan group marking the 250th anniversary of the signing of the US Constitution. The attackers registered america250[.]holiday and used it as a reverse proxy to the real site, delivering its content with malicious JavaScript added. Many of the other targeted sites had links to Russia's ongoing war against Ukraine.
Why it matters
The campaign relied on sites users trust, making it hard to spot. The use of already-patched flaws underscores how critical timely updates are.
