Researchers said Wednesday that hackers linked to the Kremlin may have exploited previously patched flaws in iOS and Android to compromise visitors to several websites, including one associated with the 250th anniversary of U.S. independence. The attackers, assessed with “moderate to high confidence” to be part of Russia’s foreign intelligence service, targeted sites connected largely to Russia’s ongoing war with Ukraine.
The campaign began when an iPhone or Android user visited one of potentially hundreds of websites. Malicious JavaScript was injected into the traffic to profile the device. A final payload tailored to the device’s operating system then attempted to steal browser cookies and, in some cases, Wi-Fi passwords and complete data from the mobile device.
A fake site targeting a national celebration
One impersonated website was america250.org, which belonged to a bipartisan group of members of Congress, business executives and at least one former Trump administration official. The attacker registered 250[.]us and used it as a reverse proxy for america250.org over the holidays. The fake site served content from the legitimate website while adding malicious JavaScript.
“We believe this website may have been deliberately selected by the intrusion set due to its association with a high-profile national celebration, and may have used this event as a pretext for an invitation-themed spear phishing campaign,” researchers at security firm Sekoia said in a report.
A second site near UK government offices
A second website, theowo[.]london, belongs to a luxury hotel located close to several of the United Kingdom’s most sensitive government offices, including the Ministry of Defence, 10 Downing Street, Government House and the offices of the British prime minister. According to open-source reports, Ukrainian President Volodymyr Zelenskyy stayed there during his visit on October 14.
Source: arstechnica.com
