In a concerning new development, cybersecurity researchers have identified a campaign led by hackers believed to be connected to the Russian government. These attackers have exploited previously addressed vulnerabilities in iOS and Android devices in efforts to compromise users visiting various websites, including one commemorating the 250th anniversary of American independence.

This coordinated hack, attributed with “moderate to high confidence” to Russia’s Foreign Intelligence Service, targets several sites that have links to the ongoing conflict in Ukraine. Users browsing these potentially compromised websites may have had their devices profiled through malicious JavaScript injected into their browsing traffic. The subsequent payloads were designed specifically to extract sensitive data, such as browser cookies and, in some instances, Wi-Fi credentials and comprehensive mobile data.

Exploiting High-Profile Events

Among the targeted websites was america250.org, which is affiliated with a non-partisan coalition that includes lawmakers, business leaders, and even an ex-member of the Trump administration. The attackers created a deceptive domain, america250.holiday, serving as a reverse proxy for the legitimate site, thereby infusing it with malicious scripts.

According to researchers from the security firm Sekoia, the selection of this specific website likely aimed to exploit the national celebration associated with it. This strategy may have been designed to enhance the effectiveness of invitation-themed spear-phishing campaigns.

Additionally, the site theowo.club was found to proxy the Raffles of London OWO, a luxury hotel situated near some of the UK’s most sensitive government establishments, such as the Ministry of Defence and 10 Downing Street, the residence of the British Prime Minister. Reports indicate that Ukrainian President Volodymyr Zelenskyy stayed at this hotel during a recent visit, further underscoring the strategic implications of these attacks.