Hackers possibly linked to the Kremlin used previously patched flaws in iOS and Android in attempts to compromise phones through websites, researchers said on November 4. The operation targeted visitors to multiple sites, including an imitation of a website associated with the 250th anniversary of American independence.
Researchers at security firm Sekoia attributed the activity to Russia’s Foreign Intelligence Service with what they described as “moderate to high confidence.” Many of the other websites targeted in the operation had connections to Russia’s ongoing war against Ukraine. The researchers said the number of sites involved could potentially reach into the hundreds.
The attack process began when someone using an iPhone or Android device visited one of the sites. JavaScript inserted into the web traffic gathered information about the visiting device. The attackers then used payloads tailored to the phone’s platform in attempts to steal browser cookies. In some cases, the attempted theft extended to Wi-Fi passwords and the device’s full mobile data.
One example involved america250.org, the website of a non-partisan organization whose members include lawmakers, business executives and at least one former Trump administration official. Rather than directing visitors solely to that legitimate address, the attackers registered a separate domain, america250[.]holiday, that served as a reverse proxy for the organization’s website.
Through that arrangement, the imitation site displayed material obtained from the genuine America250 website while adding malicious JavaScript. Sekoia’s researchers suggested that the association with a prominent national anniversary may have influenced the attackers’ choice. They assessed that the celebration could potentially provide a pretext for invitation-themed spear-phishing campaigns, rather than establishing that such campaigns had taken place.
A second imitation domain, theowo[.]club, used a similar proxy arrangement to present the website of Raffles London at The OWO. The luxury hotel is physically close to sensitive British government locations, including the Ministry of Defence and 10 Downing Street, which serves as the British prime minister’s official residence and office.
The hotel also had a reported connection to a recent visit by Ukrainian President Volodymyr Zelenskyy. According to open source reporting cited in the account, Zelenskyy stayed there during an October 14 visit. The hotel website was among the examples researchers identified in describing the broader operation against mobile visitors.
