Infected websites steal cookies and passwords from outdated smartphones, with researchers pointing to Russian intelligence
US cyber agency CISA has now put an old iPhone bug from the attack chain on its list of actively exploited flaws.
French security firm Sekoia discovered in mid-October a large-scale campaign in which legitimate websites were abused to attack visitors using an iPhone or Android device. Sekoia attributes the operation with moderate to high confidence to APT29, a hacking group linked to Russia's SVR foreign intelligence service. Malicious code was inserted into the infected sites, including those of a Ukrainian gas company, a US chemical industry trade association and a Bulgarian military organisation. In addition, lookalike domains imitated well-known sites, including that of a London luxury hotel.
According to Help Net Security, a Ukrainian analytics service, Plerdy, was also compromised for a week at the end of August, causing thousands of mostly Ukrainian sites to load the malicious script, including military-related sites. A script first profiles the visitor's device and then serves a matching attack chain, without the user having to do anything. On older iPhones, cookies or extensive data such as messages, photos and Wi-Fi passwords were taken; on Android, saved logins among other things.
All the flaws used had already been patched, so devices running the latest software are not vulnerable, Sekoia stresses. US cybersecurity agency CISA on Wednesday added one of the iPhone bugs, which Apple fixed back in May 2024, to its list of actively exploited vulnerabilities, The Hacker News reports. Federal agencies must address it by 18 November.