Russian intelligence hackers planted code on real websites and built fake copies of others, including a lookalike of the official America250 site, to break into iPhones and Android phones that had not been updated, according to a report published Wednesday by the French security company Sekoia. A visitor did not have to click anything. Opening an infected page on an old phone was enough.
Every flaw the attackers used had already been fixed by Apple, Google or Qualcomm. Sekoia says a phone running current software is safe from this campaign. The same day, the Cybersecurity and Infrastructure Security Agency added one of the Apple flaws, CVE-2024-27834, to its catalog of vulnerabilities known to be exploited and gave federal agencies until Nov. 18 to deal with it.
Sekoia's researchers say they spotted the operation in mid-October. They link it, with "moderate to high confidence," to APT29, the group also called Cozy Bear or Midnight Blizzard. Sekoia describes it as widely attributed to Russia's Foreign Intelligence Service, the SVR.
How visitors were caught
The attackers used three routes. First, they slipped a script into legitimate websites, including that of a major trade association for US chemical companies, a Ukrainian gas producer and a Bulgarian military-related site. Where they could not break into a site, they registered a lookalike address that loaded the real page and added their code to the bottom.
One of those lookalikes was america250[.]holiday, a copy of america250.org, the national initiative marking 250 years of American independence. Sekoia thinks the attackers may have chosen it as bait for fake invitations. The other copied the website of Raffles London at The OWO, a luxury hotel in the old War Office building near the Ministry of Defence and 10 Downing Street. That copy is now offline.
The third route reached the most people. From Aug. 27 to Sept. 3, the attackers tampered with a tracking script from Plerdy, a Ukrainian web analytics service loaded by thousands of websites, most of them Ukrainian. Sekoia says that exposed hundreds of websites and their visitors for that week. In each case the injected code first checked the visitor's device and browser version, and only then did the server send an exploit built for that phone.
What the attacks took
| Target | What the attackers took |
|---|---|
| iPhones on iOS 16.7 | Browser cookies |
| iPhones on iOS 18.5 | Text messages and iMessages, mail indexes, voicemail, WhatsApp and Telegram data, stored passwords, contacts, call history, calendar, notes and Safari history |
| Android phones with Chrome 139 to 145, except 143 | Chrome cookies and saved Wi-Fi passwords |
One of the iPhone chains is DarkSword, an exploit kit Sekoia suspects was built by a commercial surveillance vendor and that turned up on the VirusTotal scanning service in September. None of the payloads set themselves up to survive on the phone, Sekoia found.
Sekoia did not say how many people were hit.
It said it is working with national computer emergency teams in the affected countries to identify victims and to look at ways of disrupting the attack servers.
Which phones are protected
Apple fixed the newest iPhone flaw in the chain, CVE-2026-20700, in iOS 26.3, released in February, and the main WebKit flaw, CVE-2025-43529, in iOS 26.2 and iOS 18.7.3 last December. Google fixed the Chrome flaw, CVE-2026-3910, in Chrome 146 in March.
To check an iPhone, open Settings, then General, then Software Update. On Android, update Chrome from the Play Store and install any system update the phone offers. Phones that can no longer install those updates remain vulnerable to the flaws used here.
