---
title: "Russian hackers turn dozens of websites into smartphone traps: passwords, photos, and messages at risk"
description: "Russian hackers infected smartphones via compromised websites in Ukraine, the US, and Europe. Passwords, messenger correspondence, and photos were at risk. Apple and Google have already released patches."
date: 2026-11-05T10:19:07.204Z
lang: en
url: https://xab.info/en/posts/russian-hackers-infect-smartphones-via-compromised-websites
tags: [cybersecurity, russian-hackers, ios-vulnerability, android-exploit, pleardy, apt28, smartphone-security]
author: "Roman V."
publisher: "XAB.info"
---

# Russian hackers turn dozens of websites into smartphone traps: passwords, photos, and messages at risk

![Two smartphones displaying source code and hacking-related text against an office background.](https://xab.info/media/2026/11/05/rossiyskie-hakery-zarazhali-smartfony-cherez-saity-ukrainy-i-ssha/rossiyskie-hakery-zarazhali-smartfony-cherez-saity-ukrainy-i-ssha-1.webp)

## Key Points

- Hackers compromised the Ukrainian service Plerdy and replaced its SEO tracker, which was then loaded by thousands of websites
- The attack exploited vulnerabilities in iOS 16.7, iOS 18.5, and Chrome for Android versions 139–145
- On iOS, they stole Safari cookies, WhatsApp/Telegram data, Keychain, and photos; on Android, they stole Wi-Fi passwords, Chrome history, and logins
- Apple and Google have released updates that fix all exploited vulnerabilities

A Russian hacking group has launched a massive campaign to covertly infect smartphones by using compromised legitimate web resources as traps for unsuspecting visitors. This is reported by Bleeping Computer, citing data referenced by RBC-Ukraine. Websites in Ukraine, the US, and Europe have been hit, with infected resources including a Ukrainian gas production company, an American industrial association, and a Bulgarian military site. Researchers estimate the campaign ran for several weeks, targeting users on both iOS and Android.

### Attack vector: from SEO tracker to fake domains

A key element of the attackers' infrastructure was the Ukrainian web analytics service Plerdy. Hackers gained access to the platform and replaced its SEO tracker—a small JavaScript script downloaded by thousands of websites, primarily in Ukraine. Thus, the malicious code spread through a legitimate channel, making it virtually invisible to the end user. Simultaneously, the attackers deployed fake domains mimicking the official American portal America250 and a London hotel website to attract victims via search queries and direct links.

### How the 'invisible' exploit works

When visiting any of the infected resources, the user's browser automatically loaded the source JavaScript script. Without any human intervention—no clicks, no requests for permissions—the script scanned the device: it identified the operating system type, browser version, and other parameters. Based on the data obtained, the hackers' command server automatically sent a targeted package of specific exploits tailored to the device's specific configuration. This approach allowed for the infection of both iPhones and Android smartphones by using different sets of vulnerabilities.

### What exactly were the attackers stealing?

On iOS devices, hackers exploited vulnerabilities in iOS 16.7 and iOS 18.5. As a result of the attack, the hackers gained access to Safari browser cookies, WhatsApp and Telegram messenger databases, credentials from the Keychain memory, geolocation data, and photographs. On Android devices, they targeted vulnerabilities in the Chrome for Android browser in versions 139–145 (excluding 143). Using the specialized tool AndroSnitch, hackers extracted Chrome cookies, saved login data, browsing history, and Wi-Fi network passwords. According to researchers, none of the deployed payloads left permanent traces on the system: a simple device restart temporarily halted the malicious activity until the next visit to the infected site.

### Patches released—but the risk remains

Apple and Google have already patched all discovered vulnerabilities and released security updates, including fixes for older versions of iOS and Android. Nevertheless, experts warn: until the user installs the latest updates, their device remains vulnerable. Researchers strongly recommend checking for updates in smartphone or tablet settings as soon as possible and installing all available patches. An additional precautionary measure is to be cautious when visiting websites that do not inspire trust, as well as using traffic monitoring tools capable of detecting suspicious outgoing connections.

### Context: a series of attacks on NATO and European infrastructure

The described campaign is not an isolated incident. Against the backdrop of an ongoing information war, Russian hacking groups, including APT28, are conducting a series of attacks on the infrastructure of NATO and European countries. For example, according to Dilo, an attack was recorded in July 2026 on the internal network of a naval shipbuilding enterprise in one of the Alliance's countries, where attackers remained undetected for at least two months. The totality of these incidents points to the systematic nature of cyber operations aimed at both industrial espionage and mass infection of civilian end-user devices.

## Fact-Check & Sources

- [Российские хакеры атаковали iPhone и Android через украинский сервис: под угрозой пароли и фото](https://www.rbc.ua/ukr/news/rosiyski-hakeri-atakuvali-iphone-ta-android-1793871914.html) - Primary source. Bleeping Computer data: attack vector via Plerdy, fake domains, iOS/Android vulnerabilities, data theft, patches from Apple and Google.
- [Российские хакеры два месяца оставались незамеченными в сети оборонного предприятия НАТО](https://delo.ua/ru/news/rossiiskie-xakery-dva-mesyaca-ostavalis-nezamecennymi-v-seti-oboronnogo-predpriyatiya-nato-474749/) - Additional context: APT28 attack on a NATO shipbuilding enterprise, recorded July 24, 2026. Used for general context of the series of cyber operations.

## FAQ

### How exactly did hackers infect the smartphones?

When visiting an infected site, the browser automatically downloaded a JavaScript script that scanned the device, identified the OS and browser version, and then the command server sent a targeted exploit. No clicks or permissions from the user were required.

### What data could be stolen?

On iOS: Safari cookies, WhatsApp and Telegram databases, Keychain credentials, geolocation, and photos. On Android: Chrome cookies, saved logins, browsing history, and Wi-Fi passwords.

### What should I do to protect my device?

Install the latest iOS or Android updates as soon as possible—Apple and Google have already closed all used vulnerabilities. It is also recommended to avoid visiting suspicious sites and to use network traffic monitoring tools if necessary.

### Did the malware leave traces in the system?

No. According to researchers, no payload created permanent traces. Restarting the device temporarily stopped the malicious activity, but the attack could reoccur upon the next visit to the infected site.