One website visit and passwords were gone. Hackers attacked phones even via a Czech website, traces reportedly lead to Russia

It was enough to load a website, and there was already a risk of theft of passwords, account access, or sensitive data. Security firm Sekoia described how hackers targeted users with outdated Android or iPhone devices. Their traces reportedly led to Russia. Moreover, according to experts, infected websites also appeared in the Czech Republic.

A Czech political movement’s website was also reportedly infected

According to an analysis by Sekoia, attackers this year compromised or cloned websites in the United States, Ukraine, Bulgaria, and the Czech Republic. The domestic target was reportedly the website of a far-right movement, though its name is not specified in the detailed report. Other alleged victims included a Ukrainian gas company, an American chemical industry association, and a Bulgarian military-themed website.

If the attackers failed to compromise a website itself, they created a faithful copy. For example, they mimicked websites for the celebration of 250 years of American independence or a luxury London hotel located near the British Ministry of Defence and Downing Street. For a week between August 27 and September 3, they also took control of the Ukrainian analytical service Plerdy, which is used by thousands of predominantly Ukrainian websites.

According to Sekoia, with a “medium to high degree of certainty,” the campaign is attributed to group APT29, also known as Cozy Bear. This group is associated with the Russian Foreign Intelligence Service (SVR). The firm states that it is cooperating with the national cybersecurity teams of the affected countries in the investigation.

On an old phone, it was enough to open the page

The script on the compromised website first detected what phone and browser the visitor was using, and then sent a tailored attack. It only checked if it was indeed a phone. Anyone who visited the page with an unupdated phone was a target.

On iPhones running iOS 16 to 17.4, attackers stole cookies, i.e., logins to websites and applications. With these, they could access, for example, email without knowing the password. For iOS 18.5, they deployed the DarkSword toolset, which exfiltrated SMS, iMessage, WhatsApp, Telegram, saved passwords, photos, and location data from the phone.

On Android, the attack targeted Chrome versions 139 to 145 (excluding 143) and, according to Android Authority, phones with Snapdragon chips. Through a vulnerability in the browser and subsequently in the Adreno graphics driver, it gained deeper access to the system. It exfiltrated cookies, saved logins, and browsing history from Chrome, as well as passwords for all saved Wi-Fi networks.

An updated phone will block the attack

According to researchers, all exploited vulnerabilities were fixed before the hackers began their attacks. Thus, their methods were ineffective against users with updated phones and browsers. However, those who underestimate the importance of updates, or people who are less tech-savvy, could have been at risk.

If you are unsure whether you are using the latest version of the Chrome browser, it is worth checking the Play Store and installing any available updates. Similarly, you should check if a system update is available directly for your phone. You can find this in Settings.

When did you last update your phone?

Sources: Sekoia, Android Authority