Hackers assessed as part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities in a campaign targeting visitors to multiple websites, according to security researchers at Sekoia. The attacks, reported Wednesday, focused on sites with connections to Russia's conflict with Ukraine and a U.S. national celebration portal.

Sekoia attributed the intrusion set to APT29, a group tracked as Russian state-backed activity, with "moderate to high confidence" based on target profiles and similarities to previous operations.

The attack chain began when iPhone or Android users visited one of potentially hundreds of compromised websites. Malicious JavaScript injected into web traffic profiled the visitor's device and browser configuration. Attackers then delivered tailored payloads leveraging one of three zero-click exploit chains—attacks requiring no user interaction.

The exploits aimed to exfiltrate browser cookies, Wi-Fi passwords, and full device data. One target was america250.org, managed by a non-partisan group celebrating the 250th anniversary of American independence. Attackers registered america250[.]holiday and used it as a reverse proxy, serving legitimate content while injecting malicious code. Sekoia researchers said the group likely selected the site to leverage the high-profile event as a pretext for invitation-themed spear-phishing.

Another proxied site was theowo[.]club, which mirrored Raffles London OWO, a luxury hotel located near the UK Ministry of Defence and 10 Downing Street. Open source reporting indicated Ukrainian President Volodymyr Zelenskyy stayed at the Raffles during an October 14 visit. Researchers suggested the watering hole attack aimed to target diplomatic delegations and high-profile guests.

Attackers employed three infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and supply-chain compromise of a Ukrainian web analytics service supporting thousands of sites. A top Ukrainian gas production company also served as a compromised distribution point. The injected JavaScript remained identical across initial profiling stages, demonstrating consistent operational methodology.