A Russian hacking group has launched a massive campaign to covertly infect smartphones by using compromised legitimate web resources as traps for unsuspecting visitors. This is reported by Bleeping Computer, citing data referenced by RBC-Ukraine. Websites in Ukraine, the US, and Europe have been hit, with infected resources including a Ukrainian gas production company, an American industrial association, and a Bulgarian military site. Researchers estimate the campaign ran for several weeks, targeting users on both iOS and Android.
Attack vector: from SEO tracker to fake domains
A key element of the attackers' infrastructure was the Ukrainian web analytics service Plerdy. Hackers gained access to the platform and replaced its SEO tracker—a small JavaScript script downloaded by thousands of websites, primarily in Ukraine. Thus, the malicious code spread through a legitimate channel, making it virtually invisible to the end user. Simultaneously, the attackers deployed fake domains mimicking the official American portal America250 and a London hotel website to attract victims via search queries and direct links.
How the 'invisible' exploit works
When visiting any of the infected resources, the user's browser automatically loaded the source JavaScript script. Without any human intervention—no clicks, no requests for permissions—the script scanned the device: it identified the operating system type, browser version, and other parameters. Based on the data obtained, the hackers' command server automatically sent a targeted package of specific exploits tailored to the device's specific configuration. This approach allowed for the infection of both iPhones and Android smartphones by using different sets of vulnerabilities.
What exactly were the attackers stealing?
On iOS devices, hackers exploited vulnerabilities in iOS 16.7 and iOS 18.5. As a result of the attack, the hackers gained access to Safari browser cookies, WhatsApp and Telegram messenger databases, credentials from the Keychain memory, geolocation data, and photographs. On Android devices, they targeted vulnerabilities in the Chrome for Android browser in versions 139–145 (excluding 143). Using the specialized tool AndroSnitch, hackers extracted Chrome cookies, saved login data, browsing history, and Wi-Fi network passwords. According to researchers, none of the deployed payloads left permanent traces on the system: a simple device restart temporarily halted the malicious activity until the next visit to the infected site.
Patches released—but the risk remains
Apple and Google have already patched all discovered vulnerabilities and released security updates, including fixes for older versions of iOS and Android. Nevertheless, experts warn: until the user installs the latest updates, their device remains vulnerable. Researchers strongly recommend checking for updates in smartphone or tablet settings as soon as possible and installing all available patches. An additional precautionary measure is to be cautious when visiting websites that do not inspire trust, as well as using traffic monitoring tools capable of detecting suspicious outgoing connections.
Context: a series of attacks on NATO and European infrastructure
The described campaign is not an isolated incident. Against the backdrop of an ongoing information war, Russian hacking groups, including APT28, are conducting a series of attacks on the infrastructure of NATO and European countries. For example, according to Dilo, an attack was recorded in July 2026 on the internal network of a naval shipbuilding enterprise in one of the Alliance's countries, where attackers remained undetected for at least two months. The totality of these incidents points to the systematic nature of cyber operations aimed at both industrial espionage and mass infection of civilian end-user devices.
