Malware · Vulnerabilities · Threat Intelligence
Russian-linked hackers used fake websites to spy on iPhone and Android users
Researchers say a Russian state-backed group used fake and compromised websites to steal sensitive data from iPhone and Android users in Ukraine, the US and Europe. The attacks worked only on outdated devices.
Ross GrantUpdated 3 min read
The short version
A Russian-linked hacking group used fake and compromised websites to try to steal information from iPhone and Android users in Ukraine, the US and Europe. The attacks worked only on devices that were not up to date. Sensitive data like messages, emails and passwords could be taken without the user clicking anything. Keeping your phone and apps updated protects you from this kind of attack.
What happened?
Researchers say a Russian state-linked group used fake and compromised websites to steal sensitive data from iPhone and Android users in Ukraine, the US and Europe. The attacks worked by exploiting known vulnerabilities on outdated devices. The campaign was attributed to APT29 (Cozy Bear), but the number of victims is unknown. All exploited flaws had already been patched before the attacks began.
Who is affected
According to researchers at French cybersecurity firm Sekoia, the campaign targeted users in Ukraine, the United States and Europe. Victims included visitors to hundreds of Ukrainian websites, a major US chemical industry trade association, and a far-right European political party. The attackers also created fake versions of high-profile sites, such as America250 (a US anniversary initiative) and Raffles London at The OWO hotel, which is near British government buildings. The compromised sites may have been used to target diplomats, officials and other high-profile individuals. There is no evidence that Ukrainian President Volodymyr Zelensky, who stayed at the hotel during an October visit, was targeted.
How the attack worked
The hackers, attributed by Sekoia to APT29 (also known as Cozy Bear or Midnight Blizzard), used several methods to reach victims. They planted malicious code on legitimate websites, created convincing fake sites, and compromised a Ukrainian web analytics service called Plerdy. By inserting malicious code into Plerdy’s tracking script, they exposed visitors to hundreds of Ukrainian websites, including those linked to the military and drone manufacturers. The attackers’ code identified the device and software version of each visitor, then attempted to exploit known vulnerabilities if the device was not fully updated.
On iPhones running older versions of iOS, the attacks could steal browser and app cookies, potentially giving access to online accounts. A more advanced attack on iPhones with iOS 18.5 could extract messages, emails, passwords, contacts, photos, and location history, as well as data from messaging apps like WhatsApp and Telegram. This used a toolkit called DarkSword, previously seen in other surveillance operations. On Android devices, the hackers exploited old Chrome browser flaws to steal browsing data, cookies and saved Wi-Fi passwords. All attacks were designed for quick data theft, not long-term control of the device.
What was taken
The attackers were able to steal a wide range of sensitive information: passwords, messages, emails, browser data, contacts, photos, location history and data from messaging apps. On Android, they could also access saved Wi-Fi passwords. The attacks did not require users to click links or download files, making them “zero-click” attacks. Sekoia could not confirm how many devices were compromised or the total amount of data stolen.
Is there a fix?
Researchers said all the vulnerabilities used in these attacks had already been patched by Apple and Google before the campaign began. Devices running the latest software were not affected. The attacks only worked against outdated devices and browsers. Sekoia is working with emergency response teams in affected countries to help identify victims and disrupt the hackers’ infrastructure.
What you should do
Users should keep their devices and apps updated to the latest versions. Organisations should review their use of third-party scripts and analytics services, especially those that could be compromised to deliver malicious code. Security teams should monitor for signs of device compromise and educate users about the risks of outdated software.
Why it matters
This campaign shows how attackers can reach many people by compromising widely used websites and services. It also highlights the risks of using outdated devices and software, even when patches are available. The use of zero-click attacks means users may not realise they are at risk.
Key points
- Russian-linked hackers targeted iPhone and Android users in Ukraine, the US and Europe.
- The attacks used fake and compromised websites, including a Ukrainian analytics service.
- Sensitive data was stolen from outdated devices, including messages and passwords.
- All exploited vulnerabilities had already been patched by Apple and Google.
- Keeping devices and browsers updated is the best defence.
Sources
Recorded Future News
Reference
