Researchers say hackers linked to the Kremlin may have exploited previously patched flaws in iOS and Android to target visitors to several websites, including one associated with the 250th anniversary of US independence. The campaign, attributed with moderate to high confidence to Russia’s foreign intelligence service, used injected JavaScript to profile mobile devices and, depending on the platform, attempt to steal browser cookies, Wi-Fi passwords, and complete device data.
Watering holes targeted mobile devices
The attack began when an iPhone or Android user visited one of potentially hundreds of websites. Malicious JavaScript was injected into the traffic, allowing the attackers to identify the device and deliver a payload tailored to its operating system.
The attackers also targeted websites connected to Russia’s ongoing war with Ukraine. Researchers said the activity may have involved so-called watering-hole attacks, in which compromised or impersonated websites infect visitors rather than directly targeting them through email or other messages.
A fake US anniversary website
One impersonated site was america250.org, operated by a bipartisan group that included members of Congress, business executives, and at least one former Trump administration member. The attackers registered 250 U.S.[.]I and used it as a reverse proxy to america250.org over the holidays. The fake site served content from the legitimate website while adding malicious JavaScript.
“We believe this website may have been deliberately selected by the intrusion set due to its association with a high-profile national celebration, and may have used this event as a pretext for an invitation-themed spear phishing campaign,” researchers at security firm Sekoia said.
A second site near UK government offices
The attackers also targeted theowo[.], a luxury hotel located near several of the UK’s most sensitive government offices, including the Ministry of Defence, 10 Downing Street, Government House, and the offices of the British Prime Minister.
According to open-source reports, Ukrainian President Volodymyr Zelenskiy stayed at the hotel during his visit on October 14.
Source: arstechnica.com