Hackers exploited iOS and Android flaws to infect phones

Researchers say hackers possibly linked to Russia’s Foreign Intelligence Service used flaws in outdated iOS and Android software to target visitors to multiple websites. The campaign matters because it appears to have sought information from diplomatic and other high-profile targets, while compromising or impersonating trusted sites to reach them.

The targets included a website for the US Constitution’s 250th anniversary, a luxury London hotel, and Ukrainian websites, including a gas producer and an analytics service. Injected JavaScript profiled devices before delivering one of three zero-click exploit chains; payloads sought browser cookies and, in some cases, Wi-Fi passwords and device data. The vulnerabilities had already been patched, so the attacks worked only on devices running older software. Researchers assessed the Russian attribution with moderate to high confidence, citing the targets and similarities to a previous campaign.