Hackers Linked to Russia Used iPhone and Android Flaws to Hack Visitors to Websites

Hackers possibly working for Russia's Foreign Intelligence Service attacked visitors to multiple websites, researchers reported Wednesday.

The hackers exploited old security weaknesses in iOS and Android phones. These flaws had already been fixed by Apple and Google, so only people with outdated phones could be infected.

The attackers used a technique called injection. They added malicious code into the internet traffic when visitors accessed certain websites.

This code profiled each device to find out what type of phone it was.

One fake website copied america250.org, which belongs to a group of lawmakers and business leaders. The attackers registered a similar domain name and used it as a proxy to show real content while adding hidden harmful code.

A second target was a luxury hotel near important UK government buildings. Researchers believe the attackers may have wanted to catch high-level government visitors or diplomats who stayed there.

The hackers also compromised a Ukrainian web analytics company that serves thousands of sites. This let them reach many more potential targets.

When the injected code confirmed someone's device type, the attackers sent different exploit chains—groups of techniques designed specifically for iPhone or Android. The code tried to steal browser cookies, passwords, and other device data.

All the vulnerabilities exploited in this campaign were outdated. This means the attacks only worked on phones that had not received the latest updates.

Researchers linked this campaign to Russian hackers based on the targets chosen and similarities to previous Russian cyberattacks.