iPhone And Android Phones Targeted In No-Click Website Attacks

It's been a while since we at HotHardware covered a major cyber-attack from Russian state-sponsored cybercriminal group APT29 (aka Cozy Bear, etc), but today they're once more in the news for a spooky no-click malware campaign that targets both Android and iPhone users. Some places the campaign has been seen suggest it's explicitly being targeted at government officials or infrastructure within Ukraine or the United States (which would make sense for Russia to target), but evidence of the campaign popping up as far afield as an Australian medical clinic suggests a wider footprint.

So, how does the attack work? In short, numerous different Android and iOS browser exploits are being used to inject malicious loaders onto legitimate websites. Specifically, iOS versions 16.7 and 18.5 are being targeted, as well as Chrome for Android versions 139-145 with the exception of version 143. Cybersecurity company Sekoia, who revealed the extent of this APT29 campaign across numerous exploits used, included a helpful graph that explains it reasonably concisely:


If your iOS (for Apple devices) or Chrome (for Android) is up-to-date, and you weren't previously compromised, you have nothing to worry about. All of these attacks rely on previously-patched, publicly-known exploits. Unlike, say, the Android SMS of Death attack, this no-click exploit isn't an attack that's likely to render swathes of devices unsafe or unusable. That much is a relief, at least.

But per Sekoia's coverage, if your device was infected, you could be facing some serious damage, especially if you're an Apple user. That includes theft of cookies, which can be used for account logins or to capture other private information, and Wi-Fi password theft. Impacted Apple users additionally face full device data collection. You should immediately update your system to the latest versions and then use your account controls to revoke all active sessions and credentials, including OAuth tokens and any enterprise passwords. Then, change all of your passwords and monitor your accounts for lateral movement. Good luck!