Sekoia: Fake Websites Used to Spy on iPhone and Android Users

How the attacks work

The hackers built look-alike sites to lure visitors. One example imitated a website tied to the 250th anniversary of US independence, with a similar web address and malicious code that runs as soon as the page loads. Other lures related to the Russia-Ukraine war, and one fake site copied the official page of the Raffles hotel in London. Fake calendar invitations, event notifications and carefully crafted messages were also used to get targets to open links.

The attack unfolds in stages. JavaScript on the page inspects the browser, the device type and the operating system. Based on what it finds, the attackers pick one of three different exploit chains. Some of the attacks use a so-called zero-click technique, meaning the victim does not need to tap a link or download a file after the attack reaches the device.

Why old flaws still matter

The campaigns rely on N-day vulnerabilities: flaws that are known and already patched but remain exploitable on devices that were never updated. A user who postpones updates can therefore stay exposed even though a fix exists.

The advice that follows from the report is straightforward: install the newest iOS or Android version as soon as it is available, and keep apps and browsers updated. Avoid links in unexpected messages or unknown calendar invites, and check the web address itself before entering personal data, since a fake page can look identical to the real one. Delaying a phone update, the findings show, is not just about missing new features; it can leave a device open to known attacks used for spying and data theft.