Suspected Russian state hackers exploited patched iOS and Android flaws via websites
- Severity
- High
- Sources
- 1
What happened
Researchers assessed with moderate to high confidence that Russia's Foreign Intelligence Service ran watering-hole style attacks against visitors to multiple websites, many linked to the war in Ukraine. Attackers used a reverse proxy to serve a lookalike of america250.org with injected malicious JavaScript, which fingerprinted the device and delivered iOS or Android payloads. The payloads targeted browser cookies and, in some cases, Wi-Fi credentials and full device data. The article names the DarkSword toolkit but gives no CVE IDs or affected versions. Defenders should keep iOS and Android fully updated and review web proxy and DNS logs for lookalike domains.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Make sure iPhones and Android phones are running the latest updates, since the flaws used had already been patched.
- Be cautious of unexpected or lookalike websites, especially those linked to current events.
Written by AI from the sources, checked against them