State-linked mobile campaign turns trusted websites into attack paths

Daily Cyber News: State-linked mobile campaign turns trusted websites into attack paths

Passwords, messages and location history could be stolen from vulnerable phones simply by visiting a compromised or imitation website. Researchers attributed the campaign to Russia-linked APT29. The group planted device-fingerprinting code on legitimate sites, convincing lookalikes and a Ukrainian analytics service used by thousands of websites.

Key context: Importantly, the campaign used known vulnerabilities that Apple and Google had already patched, rather than new zero-days.

Additional detail: Enforce current mobile updates, keep outdated devices away from sensitive work and investigate unusual account activity involving users who may have been exposed.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, zero-day, State-linked, mobile, campaign, trusted, websites, attack.