Security researchers reported Wednesday that Russia's Foreign Intelligence Service deployed zero-click exploits against iOS and Android users visiting compromised websites, according to analysis by the security firm Sekoia.
The attacks targeted visitors to multiple sites, including one tied to the 250th anniversary of American independence. Sekoia assessed with moderate to high confidence that the Foreign Intelligence Service, tracked as APT29, orchestrated the intrusions.
When iPhone or Android users visited one of potentially hundreds of affected sites, malicious JavaScript profiled their devices and browsers. Tailored payloads then attempted to steal browser cookies, Wi-Fi passwords and complete mobile device data.
One target was america250.org, operated by a non-partisan group of lawmakers and business leaders. Attackers registered america250.holiday and operated it as a reverse proxy, serving content from the legitimate domain while injecting malicious JavaScript. Sekoia researchers assessed the site was chosen for its association with a national celebration, enabling invitation-themed spear-phishing.
A second target involved theowo.club, which proxied content from Raffles London OWO, a luxury hotel near the U.K. Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed at the hotel on Oct. 14. Researchers suggested the watering hole attack aimed to target diplomatic delegations and high-profile guests.
The attackers used three infection methods: direct JavaScript injection into traffic from legitimate websites, proxy domains like america250.holiday, and a supply-chain compromise of a Ukrainian web analytics service supporting thousands of websites.
The initial JavaScript injected in all cases was identical. Following device profiling, attackers deployed one of three zero-click exploit chains that required no user interaction to succeed.
