te to high confidence” were part of Russia’s Foreign Intelligence Service, targeted other sites, many with links to that country’s ongoing war against Ukraine. The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. JavaScript injected into the traffic then profiled the device. The final payloads, tailored to the type of platform visiting, attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.

Wielding DarkSword

One of the impersonated sites was america250.org, belonging to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to america250.org. The imposter website delivered content from the real one that added malicious JavaScript into it.

Read full article

Comments

28:T41b,{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://nvdium.com/en/articles/997984227#article","url":"https://nvdium.com/en/articles/997984227","headline":"Hackers exploited iOS and Android flaws to infect phones","description":"Researchers say group may have been Kremlin-sponsored in search of diplomatic targets.","datePublished":"2026-11-05T00:14:10.692Z","dateModified":"2026-11-05T00:14:10.693Z","mainEntityOfPage":"https://nvdium.com/en/articles/997984227","isAccessibleForFree":true,"inLanguage":"en","isPartOf":{"@id":"https://nvdium.com/#website"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".article-header h1","[data-testid='article-summary']"]},"articleSection":"Technology","keywords":"","image":["https://n