Hackers exploited previously patched vulnerabilities in iOS and Android in an apparent effort to infect people visiting multiple websites, security researchers said Wednesday. The campaign included sites connected to Ukraine and a website associated with the United States’ 250th anniversary celebrations.
The researchers assessed with moderate to high confidence that the attackers were part of Russia’s Foreign Intelligence Service. The operation began when iPhone or Android users visited one of potentially hundreds of websites. Malicious JavaScript inserted into the traffic profiled visitors’ devices, after which platform-specific payloads attempted to steal browser cookies and, in some cases, Wi-Fi passwords and data from the entire device.
One target was america250.org, which belongs to a non-partisan group of lawmakers and business executives that includes at least one former Trump administration official. The attackers registered america250[.]holiday and used it as a reverse proxy, serving content from the legitimate site while injecting malicious JavaScript.
Security firm Sekoia said the site may have been selected because of its connection to a high-profile national celebration, potentially providing a pretext for invitation-themed spear-phishing. The attackers also proxied the website of Raffles of London OWO, a luxury hotel near UK government institutions including the Ministry of Defence and 10 Downing Street. Open-source reporting cited by the researchers says Ukrainian President Volodymyr Zelenskyy stayed at the hotel during a visit on October 14.
Sources: Ars Technica.