Russian hackers target iPhone and Android users through compromised websites

Hackers linked to Russia have targeted iPhone and Android users through a large-scale watering hole attack using compromised websites and fake domains, multiple news outlets reported on Wednesday. Ars Technica, BleepingComputer, and The Hacker News all report that the campaign aimed to infect devices visiting these web pages. [1][2][3]

According to Ars Technica, researchers assessed with moderate to high confidence that the attackers were part of Russia's Foreign Intelligence Service. The Hacker News attributed the campaign to the Russia-linked threat actor known as APT29. BleepingComputer and The Hacker News both reported that the operation compromised legitimate websites and created fake portals impersonating legitimate ones. [1][2][3]

The campaign targeted users across multiple countries. BleepingComputer reported that high-profile websites in the United States, Ukraine, the Czech Republic, and Bulgaria delivered payloads to profile visitors. Ars Technica added that the targets included a website celebrating the 250th anniversary of the signing of the US Constitution, alongside sites linked to the ongoing war against Ukraine. [1][2]

The attackers used malicious code to evaluate visiting devices. Ars Technica and BleepingComputer reported that JavaScript injected into traffic profiled the devices and browser versions. The Hacker News reported that the operation also involved a supply chain attack that hijacked a Ukrainian web analytics service named Plerdy SEO Tracker to deliver the exploits. [1][2][3]

An exploit is a method or piece of code that takes advantage of vulnerabilities in software, operating systems, or hardware to gain unauthorized access or install malware. Ars Technica reported that the hackers exploited previously patched vulnerabilities in iOS and Android to infect target phones. [1][6]