If you are someone who likes browsing different websites, you might want to be a little careful. Cybersecurity researchers have uncovered a hacking campaign targeting iPhone and Android users that could put their personal data at risk simply by visiting an affected website. The hackers exploited security flaws in these phones to access personal information, including WhatsApp chats, passwords, photos and browsing history.What’s particularly worrying is that users did not have to click on a suspicious link or download anything. Simply opening an affected website could be enough to trigger the attack.According to a report by Ars Technica, cybersecurity firm Sekoia discovered the campaign in October 2026. Researchers believe, with moderate to high confidence, that the hackers may be linked to Russia’s Foreign Intelligence Service (SVR), although this attribution has not been independently confirmed.Which websites were used in the attack?As part of the cyber attack, the hackers reportedly used three ways to target phones. They added harmful code to genuine websites, created fake copies of trusted websites and broke into a Ukrainian web analytics service called Plerdy. Since thousands of websites use Plerdy’s tracking tool, visitors to those sites could also have been exposed to the attack.
Two fake websites particularly caught researchers’ attention. One was america250[.]holiday, which copied the official America250 website marking the 250th anniversary of American independence. The other, theowo[.]club, impersonated Raffles London at The OWO, a luxury hotel near important UK government institutions.Researchers believe the fake hotel website may have been designed to target diplomats and other high-profile guests. The campaign also involved compromised websites linked to a Ukrainian gas producer, a US chemical industry trade association and other organisations.What could hackers steal from your phone?
Once someone visited an affected website, a hidden code would check whether they were using an iPhone or Android phone and which software version was running. It would then look for security weaknesses to break into the device and steal data. The user did not have to click anything or take any action. This type of attack is known as a zero-click attack.On iPhones, hackers reportedly used a tool called DarkSword to access personal information such as text messages, WhatsApp and Telegram chats, saved passwords, photos and location details.Android phones were also targeted. Hackers attempted to steal Chrome browsing data, saved passwords, login details, browsing history and Wi-Fi passwords.How can you stay safe?While the attack is concerning, there is some reassuring news. Sekoia says the hackers exploited security flaws that Apple and Google had already fixed through software updates. This means users who have installed the latest updates are protected against the vulnerabilities used in this campaign.So, if you have been putting off a software update, now is a good time to install it. Make sure your iPhone or Android phone is running the latest software and that Chrome is up to date. It is also advised to be cautious when visiting unfamiliar websites.- Ends
Click Here For The Original Source.
——————————————————–
