The scary part of this espionage campaign isn’t a secret exploit. It’s that the flaws were old, patched, and still worked.
According to Android Headlines, researchers at security firm Sekoia say they are confident the campaign ties back to part of Russia’s Foreign Intelligence Service. The targets were iOS and Android users. The attackers went after visitors to several websites, including America250.org, a site made to mark the 250th anniversary of the Declaration of Independence.
The method was simple. The group registered a lookalike domain, copied the real site’s content so it looked legitimate, and added malicious JavaScript to profile each visitor’s device. Phishing lures got people there. Think invitation-themed messages, fake calendar invites, and event notifications. Nothing exotic, just bait that looks like routine mail.
Once someone landed on the page, the hidden script identified the device and browser. That fingerprint decided which of three zero-click exploit chains the attackers fired. Zero-click here means the victim doesn’t have to tap anything beyond loading the page. The exploits reportedly grabbed browser cookies, Wi-Fi passwords, and other private data stored on the phone.
Think about what that haul means. Stolen cookies can let an attacker hijack logged-in sessions, sometimes without needing your password or tripping a second-factor prompt. Saved Wi-Fi credentials reveal where you live, work, and travel. For a intelligence service, that’s a map of someone’s life and a foothold into their networks.
The flaws were n-day vulnerabilities. That means vendors already knew about them and had shipped fixes. Phones that never received those updates stayed exposed. So this isn’t a story about unstoppable spyware. It’s a story about the patch gap, and attackers know exactly how wide it is.
That gap is a real problem on Android in particular, where update timing depends on the manufacturer and carrier, and older devices fall off support entirely. iOS users aren’t immune either, since plenty of people delay updates or run hardware Apple no longer patches. Attackers don’t need a pricey zero-day when last year’s bug still works on millions of phones.
The use of a patriotic, event-themed site is also a pattern worth noting. State-linked groups routinely borrow trusted civic brands and big public moments because people lower their guard. Expect more of this around anniversaries, elections, and major events.
The source article offers only one piece of advice, and it’s the right one: install security updates. I’d add a few things the report doesn’t spell out, such as checking whether your phone still gets patches at all, being skeptical of unexpected invitations, and treating a lookalike domain as hostile until proven otherwise. If your device is out of support, replacing it is a security decision, not a luxury.
One caveat. Attribution rests on Sekoia’s assessment, and public details on the exploit chains are thin in this coverage. But the core lesson doesn’t depend on who was behind it. Known bugs are still doing the work, and that’s on all of us to close.