Sekoia reports hacking campaign against iPhone and Android users via compromised sites
French security firm Sekoia says attackers used compromised and fake websites to deliver exploits for already-patched iOS and Android flaws. It suspects a Russia-linked group; the two outlets differ on how firm that attribution is.
1 / 2
The story, neutrally told
Mixed · 2Researchers at the French cybersecurity firm Sekoia published findings on 4 November about a campaign that targeted iPhone and Android users through compromised websites and copies of legitimate sites. Gulf NewsN “Cybersecurity researchers at French firm Sekoia uncovered the campaign in mid-October and published their findings on November 4.” Read at Gulf News ↗ Ars TechnicaLC “researchers said Wednesday” Read at Ars Technica ↗ Mixed · 2Sekoia identified three routes to victims: direct JavaScript injection into legitimate sites, proxy or fake domains impersonating known organisations, and the supply-chain compromise of a Ukrainian web analytics service. Ars TechnicaLC “direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and the supply-chain compromise of the Ukrainian web analytics service” Read at Ars Technica ↗ Gulf NewsN “compromised legitimate websites, fake domains impersonating well-known organisations, and a hijacked website analytics service” Read at Gulf News ↗ Mixed · 2The injected code profiled each visitor's device and browser, then delivered one of three zero-click exploit chains tailored to the platform, which needed no further interaction from the victim. Ars TechnicaLC “the JavaScript profiled the visitor's browser and device. The attackers then used that information to deliver one of three zero-click exploit chains” Read at Ars Technica ↗ Gulf NewsN “the attack could proceed without further user interaction” Read at Gulf News ↗
Mixed · 2Impersonated sites included america250.org, linked to the 250th anniversary of the US Constitution's signing, and the Raffles London at The OWO hotel; Sekoia suggested the attackers may have wanted to run spear-phishing against diplomatic delegations and high-profile guests. Ars TechnicaLC “By doing this watering hole [impersonating] the Raffles London at The OWO, the intrusion set may have sought to target diplomatic delegations and high-profile guests” Read at Ars Technica ↗ Gulf NewsN “The fake websites included copies of the America250 initiative and Raffles London at The OWO hotel.” Read at Gulf News ↗ Mixed · 2Gulf News says targets were linked to organisations in the United States, Ukraine, the Czech Republic and Bulgaria. Ars Technica adds that compromised sites included a top Ukrainian gas production company. Gulf NewsN “organisations in the United States, Ukraine, the Czech Republic and Bulgaria” Read at Gulf News ↗ Ars TechnicaLC “including a top Ukrainian gas production company” Read at Ars Technica ↗ Centre · 1Gulf News reports the analytics service was Plerdy, whose tracking code was modified between 27 August and 3 September and which is used mostly by Ukrainian sites. It cautions that the number of sites loading the code is not the number of phones hacked, and that researchers did not establish how many devices were compromised. Gulf NewsN “Attackers modified the service’s tracking code between August 27 and September 3, potentially exposing visitors to malicious software.”“Researchers did not establish how many devices were successfully compromised.” Read at Gulf News ↗
Centre · 1According to Gulf News, the payloads on iOS 16.7 targeted Safari cookies. A separate attack on iOS 18.5 sought WhatsApp and Telegram databases, saved credentials, location data and photos. On Android, targeted Chrome versions were used to collect browsing history, logins, cookies and saved Wi-Fi passwords. Gulf NewsN “A separate attack targeting iOS 18.5 was designed to extract WhatsApp and Telegram databases, saved credentials, location information and photographs.”“collect browsing history, login information, cookies and saved Wi-Fi passwords” Read at Gulf News ↗ Left · 1One chain was DarkSword, an iOS exploit kit that Google researchers said customers of Turkish commercial surveillance vendor PARS Defense and at least two other threat actors have used; Sekoia did not name the other two chains. Ars TechnicaLC “One of the chains was DarkSword, an iOS exploit kit that Google researchers said customers of PARS Defense, a commercial surveillance vendor in Turkey, and at least two other threat actors have used.” Read at Ars Technica ↗ Mixed · 2All the exploited vulnerabilities were already patched "n-days", so attacks worked only on outdated software. Sekoia said devices with the latest updates were protected, the malware did not persist and a restart could stop it, though revisiting a compromised site could re-expose an unpatched device. Ars TechnicaLC “All of the vulnerabilities exploited in the campaign were “n-days,” meaning they had already been patched” Read at Ars Technica ↗ Gulf NewsN “Restarting a phone could stop the malicious activity, although visiting a compromised website again could expose an unpatched device to another attack.” Read at Gulf News ↗
Mixed · 2On attribution, Ars Technica says the researchers assessed with "moderate to high confidence" that the attackers were part of Russia's Foreign Intelligence Service, based on target profiles and similarities to a previous attack attributed to APT29. Gulf News says only that researchers suspect a link to a group previously associated with Russian intelligence and have not independently confirmed it. Ars TechnicaLC “which the researchers assessed with “moderate to high confidence” were part of Russia’s Foreign Intelligence Service”“Sekoia said its attribution to the Kremlin is based on the targets’ profiles and similarities to a previous attack attributed to APT29” Read at Ars Technica ↗ Gulf NewsN “although they have not independently confirmed the attribution” Read at Gulf News ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Ars Technica leads with the geopolitical angle: possible Kremlin sponsorship and diplomatic targets, with technical detail on proxies and exploit chains.
- Emphasis
- Attribution to Russia's Foreign Intelligence Service/APT29, the America250 and OWO hotel impersonations, the DarkSword kit.
- Leaves out or plays down
- Gives little practical advice for users and does not mention the Plerdy name, the dates of its compromise or the specific data stolen per iOS version.
- Charged language
- “Kremlin-sponsored”
- For example
-
“Researchers say group may have been Kremlin-sponsored in search of diplomatic targets.” — Ars Technica
Centre1 outlet
- Framing
- Gulf News frames it as a consumer-safety explainer: what was stolen, which devices were at risk and whether updated phones are safe.
- Emphasis
- Data at risk (messages, passwords, photos), Plerdy breach, patched status, restart and update advice, and caveats that not all users were affected.
- Leaves out or plays down
- Does not mention DarkSword, the Foreign Intelligence Service/APT29 attribution basis, or the diplomatic rationale for the targets.
- For example
-
“Users are advised to install the latest available operating-system and browser security updates.” — Gulf News
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- Sekoia published the findings on 4 November 2026.
- The campaign used compromised and impersonated websites, including America250 and Raffles London at The OWO, plus a Ukrainian analytics service.
- The exploited flaws were already patched and affected only outdated iOS and Android software.
- Researchers link the activity to a Russia-associated group.
Where accounts differ
-
Strength of the Russia attribution
- Left
- Ars Technica: researchers assessed with "moderate to high confidence" it was Russia's Foreign Intelligence Service, and says it was "possibly linked to the Kremlin".
- Centre
- Gulf News: researchers suspect a link to a group previously associated with Russian intelligence but have not independently confirmed it.
Sekoia organisation
Sekoia says it found the campaign in mid-October, assesses a Russian intelligence link with moderate to high confidence, and says fully updated devices were protected.
“We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration” — Ars Technica
“The researchers said devices running the latest available security updates were protected against the exploit chains they identified.” — Gulf News
Left1 article
-
Hackers exploited iOS and Android flaws to infect phones
Neutral Technical security report centred on suspected Russian state involvement and diplomatic targeting.
Centre1 article
-
Hackers target iPhone, Android users through compromised websites
Neutral Practical explainer with cautious wording on attribution and scope, plus advice to update devices.
Right0 articles
No coverage yet.
- 4 Nov 19:15 First Gulf NewsN Hackers target iPhone, Android users through compromised websites
- 4 Nov 22:26 +3h 12m Ars TechnicaLC Hackers exploited iOS and Android flaws to infect phones
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…