Hackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited previously patched iOS and Android vulnerabilities to compromise visitors to multiple websites, according to security firm Sekoia.
The attacks targeted sites linked to Ukraine, along with america250.org, which belongs to a non-partisan group of lawmakers and business executives marking the 250th anniversary of American independence. Attackers registered america250[.]holiday and operated it as a reverse proxy, serving content from the legitimate site while embedding malicious JavaScript.
A second victim was theowo[.]club, which proxied the official site of Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street. Open source reporting indicates Ukrainian President Volodymyr Zelenskyy stayed there on Oct. 14.
When iPhone or Android users visited one of potentially hundreds of compromised websites, injected JavaScript profiled their device. The final payloads, customized by platform, sought to exfiltrate browser cookies, Wi-Fi passwords, and full mobile device data.
Threats actors deployed attacks through three vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains, and supply-chain compromise of a Ukrainian web analytics service that serves thousands of sites. A top Ukrainian gas production company was also used to deliver attacks.
Sekoia attributed the campaign to APT29 based on targeted entity profiles and tactical similarities to previous operations. The firm's researchers detailed the findings Wednesday.
The injected JavaScript operated in stages. Initially it profiled the visitor's browser and device, then delivered one of three zero-click exploit chains that required no user interaction.
The reliance on patched vulnerabilities underscores a critical gap in enterprise mobile security: the window between patch release and widespread deployment. Sophisticated state-backed actors routinely exploit this lag to gain access before organizations can apply fixes at scale across mobile endpoints.
