Russia-Linked Hackers Used Compromised Websites To Steal Data From Unpatched iPhones & Android Phones: Cybersecurity Firm Says

A hacking campaign linked to a Russian state-backed group used compromised and fake websites to steal data from iPhones and Android phones that had not been updated, cybersecurity firm Sekoia has said. The firm says users running up-to-date software were not vulnerable.

How the attack worked

Sekoia's researchers spotted the operation in mid-October, Help Net Security reported. The campaign used what is known as a watering-hole attack, in which hackers compromise websites their targets are likely to visit. Visitors did not need to click a suspicious link or download anything. A hidden script identified the visitor's device and software version and then delivered a matching exploit.

The attackers used three routes, according to Sekoia: injecting malicious code into legitimate websites, creating lookalike copies of trusted sites, and compromising Plerdy, a Ukrainian web analytics service. The Plerdy tracking script runs on thousands of mostly Ukrainian websites. Sekoia said it served the attackers' code between August 27 and September 3, Infosecurity Magazine reported.

Which sites were involved

The investigation began with a malicious script on the website of a Ukrainian gas producer, per Help Net Security. Researchers later found compromised sites belonging to a US chemical industry trade association and a Bulgarian military-related organisation, among others. Two fake sites copied the official America250 website, which marks 250 years of US independence, and the website of Raffles London at The OWO, a luxury hotel near the UK Ministry of Defence and 10 Downing Street. Sekoia believes the hotel clone may have been meant for diplomatic delegations and prominent guests.

What could be stolen

On iPhones running iOS 18.5, attackers used the DarkSword exploit kit to reach messages, WhatsApp and Telegram data, Keychain passwords, location data and photos, Help Net Security reported. On iPhones running iOS 16.7, a separate chain stole browser cookies, which could let attackers reuse logged-in sessions such as webmail. On Android phones running Chrome versions 139 to 145, except 143, attackers could take Chrome cookies, saved logins, browsing history and Wi-Fi passwords. Sekoia said none of the payloads leave anything installed on the device.

Who is behind it

Sekoia assesses with moderate to high confidence that the campaign is linked to APT29, also known as Midnight Blizzard or Cozy Bear, a group widely tied to Russia's Foreign Intelligence Service (SVR). The firm bases this on traces of an earlier APT29 operation and similarities with a 2024 campaign. The attribution is Sekoia's assessment and has not been independently confirmed. The victim list centred on Ukraine, and Sekoia said it is unclear whether the attackers targeted specific visitors or tried to compromise as many unpatched phones as possible.

What users should do

Every vulnerability in the attack chains had already been fixed before the campaign began. "A user running an up-to-date operating system is safe from these attacks," Sekoia said, per Help Net Security. Users should install the latest iOS or Android updates and keep Chrome current. The US cybersecurity agency CISA added one of the exploited Apple flaws, CVE-2024-27834, to its Known Exploited Vulnerabilities catalogue on November 4, Help Net Security reported. It did not name who is responsible.