Hackers linked to Russia's Foreign Intelligence Service exploited previously patched iOS and Android flaws to target visitors of multiple websites, including america250.org. The attackers used JavaScript to profile devices and steal cookies, Wi-Fi passwords, and mobile data. They registered fake domains like america250[.]holiday and theowo[.]club as reverse proxies to deliver malicious code.
Researchers from Sekoia assessed the intrusion set with moderate to high confidence as part of Russia’s FIS. The attacks leveraged high-profile events and locations, including a luxury hotel near UK government offices where Ukrainian President Volodymyr Zelenskyy once stayed.
Source: Ars Technica · Summarized by HeadlinesBriefing