Hackers Target US and UK Sites Using Old Phone Flaws
Researchers say a Russian intelligence unit used impersonated websites to steal data from iPhone and Android users.
By Andrew Kovalenko ·
Cybersecurity researchers disclosed on Wednesday that a group linked to Russia's Foreign Intelligence Service successfully exploited known vulnerabilities in iOS and Android systems to compromise mobile devices. The campaign targeted visitors to several websites, including a site celebrating the 250th anniversary of American independence.
The attackers initiated the intrusion when users visited one of potentially hundreds of compromised sites. Malicious JavaScript injected into the traffic profiled the device, allowing the hackers to deliver tailored payloads. These payloads attempted to steal browser cookies, Wi-Fi passwords, and in some cases, full mobile device data. The flaws exploited were previously patched, meaning the attackers relied on outdated security versions to gain access.
One primary target was america250.org, a project run by a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. The hackers registered a look-alike domain, america250[.]holiday, and used it as a reverse proxy to the legitimate site. This setup allowed them to serve genuine content while adding the malicious code. Sekoia, the security firm behind the report, assessed with moderate to high confidence that the group is part of Russia's Foreign Intelligence Service.
The team noted that the selection of the independence site may have been deliberate. "We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns," the researchers wrote.
A second target was theowo[.]club, which proxied the website for Raffles of London OWO, a luxury hotel. The hotel is located near sensitive UK government institutions, including the Ministry of Defence and 10 Downing Street. Open source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed at that hotel during a visit on October 14.
The attacks were part of a broader effort to gather intelligence related to the ongoing war in Ukraine. The researchers said the operation began with device profiling before moving to data extraction. The use of a reverse proxy allowed the attackers to mask the origin of the malicious traffic while appearing as trusted, high-profile destinations.
