Kremlin-Linked Hackers Turned Real Websites Into Phone Spy Traps

Hackers assessed with “moderate to high confidence” to be part of Russia’s Foreign Intelligence Service spent recent months booby-trapping websites that iPhone and Android users might casually browse, Ars Technica reported Wednesday. The operation reached potentially hundreds of sites, many of them connected to Russia’s war against Ukraine. One target was a page marking the 250th anniversary of the signing of the US Constitution.

The intrusion exploited security flaws in iOS and Android that had already been patched — meaning unpatched phones were the ones at risk. The chain kicked off the moment a visitor loaded one of the compromised sites. Injected JavaScript quietly profiled the device, then served up a payload matched to whatever platform showed up.

Those final payloads went after browser cookies, and in some cases Wi-Fi passwords and full mobile device data, according to the researchers. It was a broad net cast with surgical tailoring — pick the phone, then pick the loot.

The attackers didn’t just break into sites; they impersonated them. They registered america250[.]holiday and ran it as a reverse proxy to the genuine america250.org, the site of a non-partisan group of lawmakers, business executives and at least one former Trump administration member. Visitors to the fake domain got real content from the real site — spiked with malicious JavaScript.

The campaign underscores a familiar pattern: state-linked crews leaning on flaws the public already had the tools to fix, then waiting for the stragglers. Anyone running outdated iOS or Android software on a phone that touched one of these pages could have been exposed without noticing a thing. Ars Technica published the full findings.