Sekoia says a large watering-hole campaign it ties to APT29 (Midnight Blizzard) hit iOS and Android users through compromised and lookalike sites, BleepingComputer reports.
How it worked
- Compromised sites included a Ukrainian gas producer, a US chemical trade group and a Bulgarian military-related site. Lookalikes impersonated America250 and a London hotel
- A hijacked Ukrainian analytics script was loaded by thousands of sites from Aug 27 to Sept 3
- JavaScript profiled each visitor, then served a matching exploit chain with no user interaction
- Targets: older iOS 16.7 and 18.5 (Safari cookies, WhatsApp and Telegram databases, Keychain, location, photos) and Chrome for Android 139-145 (cookies, logins, saved WiFi)
No persistence, so a reboot stops it until the next visit. Apple and Google have patched everything, including older iOS releases.
My take
“N-day” means patched bugs used against people who didn’t update. Update your phone and browser, and reboot now and then.
God Bless, and May the Source Be with You!
