Hackers target iPhone, Android users through compromised websites

Dubai: Hackers have targeted iPhone and Android users through compromised websites and convincing copies of legitimate sites, exploiting security flaws to steal personal information without requiring victims to download files or click additional links.

Cybersecurity researchers at French firm Sekoia uncovered the campaign in mid-October and published their findings on November 4.

The researchers suspect the activity may be linked to a hacking group previously associated with Russian intelligence operations, although they have not independently confirmed the attribution.

The attacks targeted visitors to compromised or fake websites associated with organisations in the United States, Ukraine, the Czech Republic and Bulgaria.

The campaign used a technique known as a watering-hole attack, in which hackers compromise websites their intended targets are likely to visit.

Malicious code embedded in the pages identified visitors' devices and browser versions before delivering attacks tailored to vulnerable software.

Once a vulnerable device loaded the page, the attack could proceed without further user interaction.

Researchers identified three methods used to reach potential victims: compromised legitimate websites, fake domains impersonating well-known organisations, and a hijacked website analytics service.

The fake websites included copies of the America250 initiative and Raffles London at The OWO hotel.

On iPhones running iOS 16.7, the malicious software targeted Safari cookies, which can contain information used to maintain website login sessions.

A separate attack targeting iOS 18.5 was designed to extract WhatsApp and Telegram databases, saved credentials, location information and photographs.

On Android devices, the attackers targeted certain versions of Chrome to collect browsing history, login information, cookies and saved Wi-Fi passwords.

Researchers did not establish how many devices were successfully compromised.

The campaign also involved a breach of Plerdy, a Ukrainian web analytics service whose tracking software was used by thousands of websites, mostly in Ukraine.

Attackers modified the service's tracking code between August 27 and September 3, potentially exposing visitors to malicious software.

However, the number of websites loading the affected code should not be confused with the number of phones successfully hacked.

Sekoia said the attacks relied on security vulnerabilities that Apple and Google have already patched.

The researchers said devices running the latest available security updates were protected against the exploit chains they identified.

The malicious software Sekoia analysed also did not establish permanent access to infected devices. Restarting a phone could stop the malicious activity, although visiting a compromised website again could expose an unpatched device to another attack.

Users are advised to install the latest available operating-system and browser security updates.