Russian hackers can infect phones just from visiting a website

A hacking group linked to Russia has been planting attack code on websites so that phones can be compromised just by loading the page. No tap or download is needed. Security firm Sekoia says the group, known as APT29 or Midnight Blizzard, targeted both iPhones and Android phones. Apple and Google have already fixed every flaw it used.

What happened

This is called a watering hole attack. Instead of chasing victims one by one, hackers booby-trap places people already visit. Some of the sites were real ones that had been broken into: a Ukrainian gas producer, a U.S. chemical industry trade association and a Bulgarian military-related site. Others were fakes that copied the official America250 site and the Raffles London at The OWO hotel site.

The fake sites passed along content from the real ones, so visitors saw what they expected. Sekoia calls this an adversary-in-the-middle setup, meaning the attacker sits between you and the genuine page.

How the attack worked

Each site first ran a small piece of code that checked what phone and browser the visitor had. A control server then sent the attack built for that exact setup. The attacks used n-day flaws. These are security holes that are publicly known and already patched, but still work on phones that have not been updated.

The group also compromised a Ukrainian web analytics service called Plerdy. Its tracking tool was loaded by thousands of websites, mostly in Ukraine, between August 27 and September 3.

Who should worry

Anyone whose iPhone or Android is missing recent security updates is exposed to this kind of attack. The chosen sites suggest a focus on Ukraine, U.S. industry and military topics, but a booby-trapped page does not check who you are before it tries. Phones that are fully up to date are protected against the flaws used here.

One piece of reassurance: Sekoia says none of the attack code stayed on the phone after it got in. Restarting the device stopped the activity, until the phone visited a compromised site again.

What to do

The steps in the alert box above cover the essentials. The main point is to install the latest update on your phone. Apple has also pushed fixes to some older iOS versions, so an older iPhone may still be able to get them.

What is not known

The material does not say how many phones were infected or what data was taken. Sekoia ties the campaign to APT29 with moderate-to-high confidence, which is a careful judgment rather than proof. Sekoia also found four other flaws in the attack code that were not used in the chains it studied.