Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign

Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign designed to steal sensitive information from iPhones and Android devices, researchers found.

French cybersecurity firm Sekoia attributed the operation to APT29, also known as Cozy Bear or Midnight Blizzard, an espionage group widely believed to operate on behalf of Russia's foreign intelligence service (SVR).

To reach potential victims, the hackers planted malicious code on legitimate websites, created fake versions of popular websites and compromised a Ukrainian web analytics service, researchers said in a report on Wednesday.

The attackers were able to steal passwords, messages, emails, browser data and other sensitive information from vulnerable devices, in some cases without requiring users to click on anything or download malicious files.

The investigation began after researchers discovered malicious code on the website of an unnamed Ukrainian gas production company. Further analysis uncovered similar compromises affecting other organizations, including a major U.S. chemical industry trade association and a far-right European political party.

The hackers also created fake versions of two high-profile websites: America250, an initiative commemorating the 250th anniversary of U.S. independence, and Raffles London at The OWO, a luxury hotel near several British government buildings.

The fraudulent websites displayed content from the legitimate sites they were spoofing while also running malicious code designed to identify visitors using vulnerable devices.

Researchers suggested that the fake America250 website could have been used to lure victims with invitations to anniversary events, while the hotel website may have been intended to target diplomats and other high-profile guests. Ukrainian President Volodymyr Zelensky reportedly stayed at the Raffles in London during an October visit, although researchers found no evidence that he was targeted.

In one of the campaign's most far-reaching operations, the attackers compromised Plerdy, a Ukrainian web analytics service used by thousands of websites, most of them based in Ukraine.

Between late August and early September, the hackers inserted malicious code into a tracking script distributed through the service, potentially exposing visitors who browsed hundreds of websites, including those associated with the Ukrainian military, special forces and manufacturers of drones and other military equipment.

The compromised script allowed the attackers to identify visitors' devices and software versions before attempting to exploit known security flaws.

Sekoia said it was unclear whether the hackers were targeting specific individuals or attempting to collect information from as many vulnerable devices as possible before identifying valuable targets.

Stealing smartphone data

The hackers used different attack methods depending on the device and operating system.

On older iPhones running iOS 16, the attacks sought to steal browser and application cookies, which could potentially allow hackers to access online accounts. A more advanced attack targeting vulnerable iPhones running iOS 18.5 could extract messages, emails, passwords, contacts, photos and location history, as well as information stored by messaging apps, including WhatsApp and Telegram.

That attack relied on a toolkit known as DarkSword, a suspected commercially developed surveillance tool capable of extracting large amounts of information from iPhones. DarkSword has previously been used by other threat actors in operations targeting users in Saudi Arabia, Turkey and Malaysia.

On Android devices, the hackers exploited vulnerabilities in older versions of Google's Chrome browser to steal browsing data, cookies and saved Wi-Fi passwords.

Unlike some spyware operations, the attacks were designed to extract information without maintaining long-term access to compromised devices.

All three attack methods relied on previously discovered vulnerabilities that Apple and Google had already patched before the campaign began. Researchers said the attacks did not exploit previously unknown software flaws, known as zero-days, and would not work against fully updated devices.

Sekoia did not establish how many smartphones were successfully compromised or how much information the hackers obtained. The company said it was working with computer emergency response teams in affected countries to identify potential victims and explore ways to disrupt the hackers' infrastructure.