Hackers exploited iOS and Android flaws to infect phones
Summary
Ars Technica reports that a Kremlin-linked intrusion set exploited patched iOS and Android flaws through watering-hole websites to infect mobile devices. The campaign used JavaScript injection to fingerprint devices and delivered zero-click payloads, including DarkSword, to steal cookies, Wi-Fi passwords, and other data. Attribution points to APT29-like activity, with targets including diplomatic and government-linked sites, and exploits described as n-days on outdated software.