Russian state-backed hackers exploited previously patched vulnerabilities in Apple iOS and Google Android to compromise mobile devices, security researchers reported Wednesday.
Security firm Sekoia assessed with moderate to high confidence that Russia's Foreign Intelligence Service conducted the campaign. The attackers targeted visitors to hundreds of distinct websites, including some linked to Russia's conflict with Ukraine.
The attack chain began when iPhone or Android users accessed a malicious site. Injected JavaScript profiled each device, then deployed customized zero-click exploit payloads designed for the specific platform. The exploits exfiltrated browser cookies, Wi-Fi passwords and comprehensive device data without requiring user interaction.
One compromised site impersonated america250.org, which belongs to a bipartisan organization comprising lawmakers, business executives and former Trump administration officials. The attackers registered america250.holiday and operated it as a reverse proxy, serving authentic content from america250.org while embedding malicious JavaScript. Sekoia assessed the attackers chose the site for its association with the U.S. independence celebration, providing a pretext for invitation-themed spear-phishing campaigns.
A second proxied domain, theowo.club, impersonated Raffles London OWO, a luxury hotel near sensitive British government institutions including the Ministry of Defence and 10 Downing Street. Open-source intelligence indicated Ukrainian President Volodymyr Zelenskyy stayed at the hotel during an October 14 visit. Researchers concluded the attackers aimed to target diplomatic delegations and high-profile guests through focused spear-phishing.
The campaign also leveraged compromised websites, including a major Ukrainian gas production company and a Ukrainian web analytics service supporting thousands of websites. Sekoia attributed the operation to Russia's Foreign Intelligence Service based on targeting profiles and similarities to previous operations by APT29, a known Russian threat group.
The hackers deployed three primary infection vectors: direct JavaScript injection into legitimate website traffic, proxy domains like america250.holiday, and supply-chain compromise via the Ukrainian analytics service. The injected JavaScript remained consistent across all methods, initially collecting browser and device information to enable deployment of platform-specific exploit chains.
