DarkSword attack targeted iOS and Android
Researchers assessed with medium to high confidence that the attackers may have been affiliated with the Russian Foreign Intelligence Service.
Quick Look
- Researchers announced that Kremlin-linked hackers used patched iOS and Android vulnerabilities.
- The DarkSword operation targeted multiple sites, including america250.org, and was assessed with medium to high confidence that the attackers were affiliated with the Russian Foreign Intelligence Service.
AI-generated summary
Why It Matters
Researchers announced that hackers, who may be linked to the Kremlin, used previously patched iOS and Android vulnerabilities. The operation, known as the DarkSword attack, targeted visitors of many sites. One of these sites in particular celebrates the 250th anniversary of the independence of the United States.
Researchers announced that hackers, who may be linked to the Kremlin, used previously patched iOS and Android vulnerabilities. In addition, the operation, known as the DarkSword attack, targeted visitors of many sites. One of these sites in particular celebrates the 250th anniversary of the independence of the United States.
Who does the DarkSword attack point to?
Researchers assess with "medium to high confidence" that the attackers were part of Russia's Foreign Intelligence Service. So this is an evaluation and this is evident from the statement. For this reason, the level of trust comes to the fore rather than a definitive judgment for the DarkSword attack.
Attackers also targeted other sites, many linked to Russia's war against Ukraine. Therefore, the operation was not limited to a single address. Moreover, the target list seems extensive.
How does the attack work?
The attack begins when someone using an iPhone or Android opens one of the targeted sites. The number of these sites is potentially hundreds. Then the JavaScript code injected into the traffic comes into play and first profiles the device.
After this, the final payload enters. In other words, the actual malware released onto the device is specially prepared according to the platform visited. Because the same software is not used for every device. These software try to steal browser cookies.
In some cases, it also targets Wi-Fi passwords and all mobile data on the device. However, this data can open up a wide range of information about visitors to attackers. However, which data is stolen in which situation varies depending on the platform.
america250.org was spoofed
One of the imitated sites was america250.org. This site is owned by a non-partisan group of lawmakers and business people. The group also includes at least one former member of the Trump administration.
The attackers registered the domain name america250[.]holiday for this. This address acted as a reverse proxy to the real site. Thus, the fake site served the content by taking the content from the real site and adding malicious JavaScript to the page. That's why the visitor saw a page that looked like the real site.
It should also be noted that the vulnerabilities used have been patched before. Therefore, users who do not keep their iOS and Android devices updated are at risk. As a matter of fact, the DarkSword attack shows that patched vulnerabilities can still work on unupdated devices.
Finally, according to the information reported by the researchers, the attack findings were shared on Wednesday, November 5, 2026. Therefore, the first technical details about the DarkSword attack reached the public on this date.
Open Questions
- Which specific sites were targeted?
- Is it clear how many devices were damaged?
- What is the full scope of the attack and the amount of damage?
