Hackers possibly linked to the Kremlin used iOS and Android exploits against website visitors, turning already-patched flaws into attempts to steal mobile data, security researchers said on November 4, 2026. The campaign combined compromised websites with impersonated pages, including a US anniversary site and a London luxury hotel’s website, to deliver attacks that required no further interaction from visitors.
Key takeaways
Sekoia linked the campaign to the suspected Russian intelligence group APT29.
Malicious JavaScript profiled visitors before attackers selected mobile exploits.
Impersonated sites included america250.org and Raffles of London OWO.
The payloads sought cookies and, in some cases, passwords and full device data.
Kremlin-linked campaign used patched iOS and Android exploits
Security firm Sekoia assessed that the attackers were linked to Russia’s Foreign Intelligence Service, citing target profiles and similarities to an earlier attack attributed to APT29 . The Kremlin connection remains an attribution assessment rather than an established fact.
The iOS and Android exploits in the suspected Kremlin-linked campaign targeted vulnerabilities for which patches already existed. These flaws are known as “n-days” , distinguishing them from previously unknown vulnerabilities. The campaign targeted outdated versions of the mobile operating systems.
Impersonated websites delivered malicious JavaScript
The attackers used reverse proxies to reproduce legitimate website content while adding malicious JavaScript. In this watering hole approach, visitors encountered an impersonated site that delivered both the real page’s content and the attackers’ code.
One domain, america250[.]holiday , proxied america250.org, a website associated with the 250th anniversary of American independence. Another, theowo[.]club, reproduced the website of Raffles of London OWO , a luxury hotel.
The injected JavaScript first examined the visitor’s browser and device. Attackers then used that profile to choose an exploit chain suited to the platform, rather than sending every visitor the same payload.
Three delivery routes led to data-theft payloads
Sekoia identified three infection routes: direct JavaScript injection into legitimate website traffic, attacker-controlled proxy domains, and a supply-chain compromise involving a Ukrainian web analytics service. The same JavaScript appeared across all three routes.
Compromised websites included a major Ukrainian gas production company. The affected analytics service served thousands of websites, providing another route for delivering the code to visitors.
In certain instances, the final payloads sought to extract Wi-Fi passwords and complete mobile device data, in addition to browser cookies . Those were the attackers’ collection objectives; the payloads were tailored to the type of device visiting the page.
DarkSword connected the campaign to surveillance tooling
One exploit chain was DarkSword , an iOS exploit kit previously associated with commercial surveillance customers and other threat actors. The campaign used zero-click exploit chains, which required no additional interaction from the target after visiting an affected page.
Google researchers had earlier traced DarkSword usage to customers of PARS Defense , a Turkey-based commercial surveillance vendor, as well as to at least two other threat actors. Sekoia identified DarkSword as one of the exploit chains used in this campaign.
Target profiles pointed to diplomatic interests
Several targeted sites had connections to Russia’s war against Ukraine or to locations near sensitive UK government institutions. Raffles of London OWO is close to the Ministry of Defence and 10 Downing Street.
Sekoia suggested that the American anniversary site’s association with a prominent national celebration offered a possible pretext for invitation-themed spear-phishing. The researchers also assessed that impersonating the London hotel potentially served attempts to reach diplomatic delegations and high-profile guests.
Ukrainian President Volodymyr Zelenskyy stayed at the hotel during a visit on October 14, according to open-source reporting cited in the account of the campaign.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
