# Hackers Exploit iOS and Android Flaws to Target Mobile Users State-linked attackers used malicious JavaScript to compromise mobile devices via spoofed websites. - **Source:** [Biz & IT - Ars Technica](https://arstechnica.com) - **Published:** 2026-11-04 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/f3a6cabe-12ed-4794-97dc-02559893dbfc ## State-Linked Cyber Campaign Identified Researchers identified a sophisticated cyber campaign targeting mobile users through exploited iOS and Android vulnerabilities. The attackers, assessed with moderate to high confidence to be part of the Russian Foreign Intelligence Service, utilized these flaws to compromise devices. This operation specifically targeted visitors of various websites, including those related to political events. ## Spoofing the America250 Initiative The attackers targeted the website america250.org, which commemorates the 250th anniversary of American independence. By registering a lookalike domain, america250.holiday, they created a reverse proxy to the legitimate site. This allowed them to intercept traffic and inject malicious JavaScript code directly into the content viewed by unsuspecting website visitors. ## Technical Execution of Attacks The attack sequence begins when a user visits a compromised site. JavaScript injected into the network traffic profiles the specific device platform. Once the device type is identified, the attackers deploy tailored payloads designed to steal sensitive information, including browser cookies, Wi-Fi passwords, and comprehensive data stored on the mobile device. ## Strategic Targeting of Websites Beyond the America250 portal, the attackers compromised hundreds of different websites. Many of these targeted platforms maintained direct links to the ongoing conflict between Russia and Ukraine. This pattern suggests a strategic effort to monitor individuals or gather intelligence related to geopolitical interests through the exploitation of mobile browser vulnerabilities. ## Exploiting Patched Vulnerabilities The campaign relied on exploiting previously patched flaws within iOS and Android operating systems. This indicates that the attackers specifically targeted users who had not updated their devices to the latest security versions. By leveraging known vulnerabilities, they bypassed standard protections, highlighting the critical importance of maintaining up-to-date mobile software environments. ## Scope of Data Theft The malicious payloads were highly platform-specific, ensuring maximum effectiveness against both iPhone and Android users. The primary objective was the exfiltration of private data, ranging from authentication tokens like browser cookies to network credentials such as Wi-Fi passwords. This level of access grants attackers significant control over the victim's digital identity. ## Political and Corporate Exposure The compromised America250 organization includes a diverse group of lawmakers, business executives, and former government officials. By targeting this specific site, the attackers potentially gained access to high-value individuals associated with the American political establishment. The use of a non-partisan group as a lure demonstrates a calculated approach to intelligence gathering. ## Implications for Mobile Security This operation underscores the persistent threat posed by state-sponsored actors against mobile infrastructure. The ability to compromise devices through simple web browsing remains a major security challenge for global users. Organizations and individuals must prioritize security updates to mitigate the risk of exploitation by sophisticated entities utilizing advanced, platform-specific attack vectors. ## Sources covering this story - https://arstechnica.com/security/2026/11/hackers-exploited-ios-and-android-flaws-to-infect-phones/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._