TECHNOLOGY · FOCUS
Attacks on iOS and Android exploit previously patched vulnerabilities
Sekoia describes a campaign targeting phones through compromised or impersonated websites, Ars Technica reports. The exploit chains used previously patched vulnerabilities. Attribution to Russian intelligence services remains the researchers' assessment, with a stated confidence level.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Attackers exploited previously patched vulnerabilities in iOS and Android to try to compromise the phones of website visitors, according to Sekoia research reported by Ars Technica. The malicious payloads sought to steal browser cookies and, in some cases, Wi-Fi passwords as well as the phone's full data.
The campaign combined compromised websites, domains impersonating legitimate sites and the compromise of a Ukrainian audience analytics service. The injected JavaScript code first identified the visitor's browser and device. This information was then used to select a suitable exploit chain capable of working without further interaction from the target.
Sekoia assesses with moderate to high confidence that the attackers were part of Russia's foreign intelligence service. This attribution rests in particular on the targets' profiles and similarities to an attack previously attributed to APT29. It must remain presented as the researchers' assessment.
The clearest operational point concerns the exposed versions: all the vulnerabilities used had already been patched. The attacks described therefore worked only on older versions of iOS or Android. This underscores the value of updates against this specific campaign, without establishing that an updated phone would be protected against every other method of intrusion. The article provides no figures on the number of devices actually compromised.