NewsCompaniesFlawsGuides
Get the app

Russian-linked hackers hit iPhones and Android phones through websites, but only phones missing updates

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Sekoia attributes the campaign to APT29 (also called Midnight Blizzard), a group widely believed to work for Russia's foreign intelligence service. Visitors to compromised websites and lookalike sites, including fakes of the America250 site and a London hotel, received code that identified their phone and then tried a matching attack. The group also tampered with a script from Ukrainian analytics service Plerdy, which thousands of sites loaded between 27 August and 3 September. Targeted phones were iPhones on iOS 16.7 and iOS 18.5 and Chrome 139 to 145 on Android (except 143). The attacks could steal cookies, saved logins, messages, photos and location, and no tap was needed. Apple and Google had already fixed every flaw used, so no zero-day was involved. Sekoia says the code did not survive a restart, and did not say how many phones were hit.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

Timeline

  1. HARD publishes its alert, at High.

What to do

  1. Open Settings > General > Software Update and install the latest iOS, and Chrome's latest version from the Play Store on Android.
  2. Do the same on parents' phones, especially older iPhones that stay on an older iOS.
  3. Restart any phone you suspect, and if you visited an unfamiliar site, change passwords from a trusted device and sign out all other sessions in each account's security settings.
  • Apple every Apple flaw being used in attacks
  • Google every Google flaw being used in attacks
  • Android every Android flaw being used in attacks

References

  1. BleepingComputer (). “Hackers use n-day exploits in zero-click attacks on iOS, Android devices”.
  2. The Record (). “Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign”.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.