Kremlin-linked hackers exploit iOS and Android flaws to infect phones
Original title: Hackers exploited iOS and Android flaws to infect phones
Attackers injected JavaScript to profile devices and steal cookies, Wi-Fi passwords, and full device data from visitors to targeted sites including america250.org.
Hackers possibly linked to Russia's Foreign Intelligence Service exploited previously patched iOS and Android flaws. The attacks began when users visited one of potentially hundreds of websites, including one celebrating the US Constitution anniversary. JavaScript injected into the traffic profiled the device, after which tailored payloads stole browser cookies and, in some cases, Wi-Fi passwords and full mobile device data. One impersonated site proxied america250.org using a reverse proxy at america250[.]holiday.
Unconfirmed: moderate to high confidence in attribution to Russia’s Foreign Intelligence Service
- Targets include sites linked to US Constitution anniversary and UK government institutions
- Payloads steal browser cookies, Wi-Fi passwords, and full mobile device data
- Attribution assessed with moderate to high confidence
- Threat actors
- Russia’s Foreign Intelligence Service
- Countries
- RussiaUkraineUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | america250.holiday | ember of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to america250.org. The imp |
| domain | theowo.club | earchers from security firm Sekoia said . A second website, theowo[.]club, proxied the website Raffles of London OWO, a luxury hote |
From the original article
1 min read at arstechnica.com
Researchers say group may have been Kremlin-sponsored in search of diplomatic targets.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.