# Russian hackers hit iPhones and Androids via websites

> Kremlin-linked attackers exploited patched flaws to infect visitors to hundreds of sites, including one marking America's 250th anniversary.
- Title: Russian hackers hit iPhones and Androids via websites
- Summary: Kremlin-linked attackers exploited patched flaws to infect visitors to hundreds of sites, including one marking America's 250th anniversary.
- Keywords: russia, ios, android, kremlin, foreign intelligence service, sekoia, america250.org, darksword, zero-click exploits, Ars Technica
- Source: Ars Technica — https://arstechnica.com/security/2026/11/hackers-exploited-ios-and-android-flaws-to-infect-phones
- Published: 2026-11-04T22:26:49+00:00
- Read time: 1 min
- Topics: russia, ios, android, security, kremlin, foreign intelligence service, sekoia, america250.org, darksword, zero-click exploits, technology, science
## Kremlin hackers target phone users
Attackers assessed with moderate to high confidence as part of Russia's Foreign Intelligence Service exploited patched iOS and Android flaws to infect website visitors.
## How the attack worked
JavaScript injected into website traffic profiled each device. Tailored payloads then attempted to steal browser cookies, Wi-Fi passwords, and full mobile device data from iPhone and Android users.
## America250 website impersonated
Attackers registered america250.holiday as a reverse proxy to america250.org, belonging to a non-partisan group of lawmakers and business executives. Researchers assessed the selection was deliberate, leveraging the 250th anniversary celebration for spear-phishing campaigns.
## Luxury hotel near UK government targeted
A second impersonated site, theowo.club, proxied Raffles of London OWO, a luxury hotel near the Ministry of Defence and 10 Downing Street. Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14.
## Supply chain and direct compromises
Attackers also compromised websites including a top Ukrainian gas production company and a Ukrainian web analytics service serving thousands of websites. Three infection vectors delivered the same injected JavaScript to profile visitors.
## Exploits required outdated software
All vulnerabilities exploited were n-days, already patched.Attacks worked only on outdated iOS or Android versions.One chain was DarkSword, an iOS exploit kit previously used by PARS Defense and at least two other threat actors.
## Key takeaway

Russia's Foreign Intelligence Service exploited already-patched iOS and Android flaws to target visitors of multiple websites, including america250.org, researchers said Wednesday.