Russian hackers used fake websites to steal data from phone users
Researchers say the Foreign Intelligence Service targeted visitors of specific sites to extract passwords and device information.
By Samir Patterson ·
Researchers from the security firm Sekoia identified a campaign by hackers they believe are linked to Russia’s Foreign Intelligence Service. The group exploited previously patched security flaws on iPhone and Android devices to infect phones. The attacks began when users visited specific websites that were set up to look like legitimate pages.
The hackers registered lookalike domains to serve as reverse proxies for real websites. One of these was america250.holiday, which mimicked america250.org. That real site belongs to a non-partisan group of lawmakers and business executives celebrating the 250th anniversary of American independence. When a user visited the fake site, malicious JavaScript was injected into the traffic to profile the visiting device.
Sekoia stated with moderate to high confidence that the intrusion set was part of the Foreign Intelligence Service. They suggested the attackers chose the America 250 site because the high-profile celebration provided a good excuse for invitation-themed phishing emails. The code tailored to the specific mobile platform attempted to steal browser cookies.
In some cases, the payloads went further to capture Wi-Fi passwords and full mobile device data. The campaign potentially targeted hundreds of different websites. Many of the other sites had connections to the ongoing war in Ukraine. The attackers used these sites to identify and infect specific visitors.
Another targeted site was theowo.club, which proxied the website for Raffles of London OWO. This luxury hotel is located near sensitive UK government institutions, including the Ministry of Defence and 10 Downing Street. Open source reports indicate that Ukrainian President Volodymyr Zelenskyy stayed at that hotel during a visit on October 14.
The researchers noted that the attackers leveraged the physical proximity of the hotel to government offices. The use of patched flaws suggests the attackers were looking for specific, high-value targets rather than a wide net. The discovery came to light on Wednesday as part of a detailed analysis of the intrusion set.
