Russian state-linked hackers use compromised and fake websites to steal data from iPhones and Android phones

French security firm Sekoia has attributed a mobile espionage campaign to APT29, also known as Cozy Bear or Midnight Blizzard, a group widely believed to work for Russia's foreign intelligence service. The targets were users in Ukraine, the United States and Europe. According to the researchers, the attackers could steal passwords, messages, emails, browser data and other sensitive information from vulnerable iPhones and Android devices, in some cases without the user clicking anything or downloading a malicious file.

The attackers reached victims in several ways. They planted malicious code on legitimate websites, built fake copies of popular sites, and compromised Plerdy, a Ukrainian web analytics service used by thousands of websites, most of them in Ukraine. The investigation began when researchers found malicious code on the website of an unnamed Ukrainian gas production company. They then found similar compromises at a major US chemical industry trade association and a far-right European political party.

The fake sites imitated America250, the initiative marking the 250th anniversary of US independence, and Raffles London at The OWO, a luxury hotel near several British government buildings. They showed content from the real sites while running code designed to identify visitors using vulnerable devices. Researchers suggested the fake America250 site could have lured victims with event invitations, and the hotel site may have aimed at diplomats and high-profile guests. They found no evidence that Ukrainian President Volodymyr Zelensky was targeted.