HACKERS EXPLOITED IOS AND ANDROID FLAWS TO INFECT PHONES

Summary from the TLDR InfoSec newsletter

Attackers likely linked to Russia's Foreign Intelligence Service used watering holes, proxy domains, and a compromised Ukrainian analytics service to inject JavaScript into mobile traffic. The code profiled visitors and delivered zero-click exploit chains against outdated iOS or Android devices, including DarkSword. Payloads sought browser cookies, Wi-Fi passwords, and full device data. Targets included sites connected to US and UK diplomatic circles and Ukraine.