Researchers at security firm Sekoia uncovered a large watering-hole campaign in which compromised sites, and sites impersonating legitimate ones, were used to attack iOS and Android users. According to BleepingComputer, JavaScript on the sites profiled the visitor's device and browser version, and the command server pushed a matching chain of exploits for known (n-day) flaws, with no user interaction. The goal was to extract cookies, messaging app databases and credentials.
The compromised sites included a Ukrainian gas producer, a US chemical industry trade association and a Bulgarian military-related site, along with lookalike domains impersonating the America250 site and the Raffles hotel in London. The attackers also compromised Ukrainian analytics service Plerdy and modified a tracking script loaded by thousands of sites, mostly in Ukraine, between August 27 and September 3. Sekoia attributes the operation, with moderate-to-high confidence, to Russian group APT29 (Midnight Blizzard).
What to do: according to Sekoia, the payloads did not persist after a reboot. Apple and Google have patched every flaw used, with fixes reaching older iOS releases too, so users should install the latest security updates on their phones.