Kremlin-linked hackers hit iOS and Android via patched flaws
Original: Hackers exploited iOS and Android flaws to infect phones
Why This Matters
SVR-linked watering holes hitting patched flaws signal persistent risk even on updated devices.
Researchers at Sekoia linked a suspected Russian SVR campaign to watering-hole attacks on iOS and Android users, targeting diplomatic visitors via sites including america250.org and a London luxury hotel.
Hackers assessed with 'moderate to high confidence' to be Russia's Foreign Intelligence Service (SVR/APT29) exploited previously patched iOS and Android vulnerabilities in a multi-vector campaign uncovered by security firm Sekoia. Attackers used three delivery methods: injecting malicious JavaScript into legitimate site traffic, registering lookalike proxy domains, and compromising a Ukrainian web analytics service that feeds thousands of downstream sites.
Among the impersonated targets: america250[.]holiday proxied america250.org—a site tied to a bipartisan U.S. group marking the 250th anniversary of American independence—and theowo[.]club proxied the Raffles London at The OWO, a luxury hotel steps from the UK Ministry of Defence and 10 Downing Street. Ukrainian President Zelenskyy stayed at the Raffles during an October 14 visit. Sekoia believes both were chosen to reach diplomatic and high-profile government targets.
Once a visitor landed on a compromised or spoofed page, injected JavaScript silently profiled the device. Tailored zero-click exploit chains then deployed payloads aimed at stealing browser cookies, Wi-Fi credentials, and full mobile device data. Attribution rests on target profiles and tactical overlap with prior APT29 operations.