State-linked actors targeted mobile users via website exploits
Researchers have identified a cyber-espionage campaign utilizing compromised websites to deliver malicious payloads to iOS and Android devices.
Security researchers have identified a cyber-espionage campaign potentially linked to the Russian Foreign Intelligence Service that targeted visitors of various websites. By using compromised domains, attackers injected malicious JavaScript into traffic to profile mobile devices and deploy targeted exploits.
The operation involved creating a proxy site, america250[.]holiday, to impersonate an official portal dedicated to the 250th anniversary of the U.S. Constitution. When unsuspecting users visited the site, the injected code attempted to circumvent security protocols to steal browser cookies, Wi-Fi passwords, and sensitive device data.
The campaign highlights an ongoing trend of using previously patched vulnerabilities to compromise mobile platforms. Experts suggest the attackers specifically sought to gain intelligence related to the ongoing war in Ukraine by targeting sites associated with geopolitical discourse.
While the specific number of successful infections remains under investigation, the method demonstrates a sophisticated approach to mass-targeted surveillance. Security analysts recommend that users keep their mobile software updated to the latest versions to protect against these types of known exploits.