Hackers believed to be linked to Russia’s Foreign Intelligence Service used previously patched iOS and Android vulnerabilities to target visitors of a range of websites, including one celebrating the 250th anniversary of the U.S. Constitution, researchers announced on Wednesday.
The attacks began when iPhone or Android users accessed one of potentially hundreds of sites. Malicious JavaScript was injected into the traffic, profiling the device and then delivering a final payload that was tailored to the platform. The payloads attempted to steal browser cookies, and in some cases Wi‑Fi passwords and full mobile‑device data.
One of the impersonated sites was america250.org, a non‑partisan group of lawmakers, business executives and a former Trump administration member. The attackers registered the domain america250.holiday and used it as a reverse proxy to the real site, delivering content that included the malicious JavaScript.
Researchers assessed the attackers with “moderate to high confidence” and noted that many of the targeted sites had links to Russia’s ongoing war against Ukraine. The use of already patched flaws highlights the continued risk to mobile users who visit compromised or spoofed websites.
<small>Source: Ars Technica — read the original story there.</small>
