Russian-linked campaign hits iPhone and Android via hijacked sites and fake portals

En bref

• Russian-linked actors run a broad mobile campaign against Apple and Google platforms.
• Hijacked sites and counterfeit sign-in pages lead to exploits needing no user action.
• Known but unpatched flaws are abused, and no CVE IDs are tied to the activity.
• Handset takeover can expose email, MFA, and sensitive school data.

An intrusion set tied to Russia is running a wide campaign against mobile users on both Apple and Google platforms, according to the available facts. The operation uses hijacked websites and counterfeit sign-in pages as lures, then pivots to exploits that need no tap or download from the victim. The result is takeover of the handset rather than a simple credential theft.

Because the activity spans iPhone and Android devices, organizations cannot treat it as a single-platform patching problem. The campaign is described as broad, and it leans on abuse of known flaws for which fixes may already exist but have not reached every device. No CVE identifiers have been assigned to this reporting, which complicates tracking and prioritization.

For a K-12 environment, mobile endpoints often carry district email, multifactor authentication prompts, and access to student records. A no-interaction exploit removes the usual user-defense moment, so patch latency and web filtering matter more than warnings alone. Counterfeit portals also blur the line between phishing and exploit delivery.

Context: watering-hole style site compromise lets attackers choose targets by audience rather than by direct spear-phishing. Watch for vendor advisories, sudden mobile authentication anomalies, and domains that mimic district login pages. The absence of CVE IDs does not mean no risk; it means defenders should rely on behavior and patch posture.

À faire maintenant

1. Force iOS and Android updates to the latest available release; set a short compliance deadline for managed and BYOD devices.
2. Block or alert on newly observed domains and known hijacked sites at the web gateway and DNS layer.
3. Enable mobile threat defense or equivalent telemetry to catch no-interaction exploit behavior and post-compromise anomalies.
4. Require phishing-resistant MFA and reauthenticate sessions from mobile devices showing unusual location or device posture.
5. Hunt for mobile sign-in anomalies, new device enrollments, and mailbox rule changes; isolate affected handsets.
6. Warn staff about counterfeit sign-in pages, but do not rely on user awareness for zero-click delivery.
7. Track Apple and Google security advisories and prioritize known-flaw abuse even when no CVE is cited.

Source originale

BleepingComputer