US — Ars Technica

Hackers exploited iOS and Android flaws to infect phones

SecurityNovember 5, 20262 min read

Hackers linked to Russia's Foreign Intelligence Service used old, already-fixed flaws in iPhone and Android systems. They tricked visitors to fake copies of real websites to infect their phones.

What happened

Security researchers say hackers possibly linked to the Kremlin (the Russian government) used flaws that had already been patched, or fixed, in iOS (Apple's phone system) and Android (Google's phone system). The attacks used fake versions of real websites. One of them copied a website celebrating the 250th anniversary of the US Constitution. When a phone user visited one of these sites, hidden code checked the device and then sent a tailored attack to steal data.

Key facts

Researchers have moderate to high confidence that the attackers worked for Russia's Foreign Intelligence Service.
The attacks may have used potentially hundreds of different sites.
Some attacks tried to steal browser cookies (small files that remember who you are online).
In some cases, the attacks also tried to steal Wi-Fi passwords and full phone data.

How the fake sites worked

The hackers set up a fake site, called a reverse proxy, that looked like a real one. It showed the real site's content but secretly added harmful code. One fake copy was made for america250.org, a site run by a non-partisan group of lawmakers and business leaders. Another fake copy copied a luxury London hotel, Raffles of London OWO, which is close to important UK government buildings. Ukrainian President Volodymyr Zelenskyy reportedly stayed there in October.

Why it matters

This shows that hackers can attack phones just by visiting a website, with no need to click a bad link or download an app. Because the attacks used old flaws, people who had not updated their phones were at risk. The researchers also think the hackers chose the America 250 site to trick people with fake invitations, which is a type of spear-phishing (targeted scam messages).

What to watch

Whether Apple and Google release new updates to close these flaws.
Whether more fake copies of websites are found.
Whether the hackers target more people linked to government or events.
Keep phones updated to the newest version.

Glossary

iOS: Apple's operating system, the software that runs iPhones.
Android: Google's operating system, the software that runs many phones.
reverse proxy: A server that quietly passes content from a real website, used here to make a fake copy.
browser cookies: Small files a web browser saves to remember your activity on websites.

Apple turns iCloud into spy cloud, will start looking at public share links

Apple plans to scan publicly accessible iCloud share links, created with the "Anyone with the Link" option, for "harmful content," according to a support page published Tuesday. The company has not defined what counts as harmful, has not explained how the checks will work, and says it can remove content or involve law enforcement. The checks are slated to begin with iOS, iPadOS, macOS and visionOS 27.3, which is in developer beta with general release expected in December.

SecurityTechCrunchNov 5

Hackers stole DreamHost customer files and inboxes during months-long attack

Web host DreamHost confirmed that hackers stole customer emails and credentials during a months-long cyberattack that began in August. The company disclosed the breach after an outage lasting several days, during which it reset some customer passwords. DreamHost said attackers exploited an unspecified vulnerability in its file manager and obtained session tokens, and that the number of affected customers is "well under 10%."

SecurityArs TechnicaNov 5

Binance says hackers who stole billions in crypto spent months planning heist

Binance said the hackers behind the theft spent months on the attack, using social engineering and novel malware, and that the campaign began no later than June and ended last Thursday with the compromise of an engineer's laptop. The FBI and TRM Security attributed the heist to North Korean actors, which initially targeted $6.34 billion from Binance wallets. Binance said it has frozen or intercepted $2.85 billion of that sum and has set aside funds to cover the loss.

SecurityITmediaNov 4

Muji's MUJI Card Full Card Numbers, About 1.09 Million Records Possibly Leaked in Unauthorized Access Follow-Up

Ryohin Keikaku said credit card information, names, and addresses that it had initially excluded may also have been accessed by outsiders in the unauthorized access to its MUJI app. Newly identified data includes about 1.09 million member records for the MUJI Card, covering full card numbers, MUJI Card IDs, and birth dates, of which about 345,000 cards remain valid.