Booby-Trapped Sites Target Mobile Visitors

APT29-linked operators compromised trusted websites and a web-analytics supplier to silently target visitors’ mobile devices. Related campaigns also used World Cup-themed ads, fake prize pages, and instructions to open pages in Safari to steer iPhone users toward browser exploits. The practical awareness lesson is that a familiar site, ad, or “you won” message can still lead to a compromised page.

Key findings

• APT29-linked activity dubbed Poisoned Source injected malicious JavaScript into legitimate websites, lookalike domains, and the Plerdy SEO Tracker service.
• The malicious code identified visitors’ devices and browsers before delivering an iOS- or Android-specific exploit chain.
• The campaign affected sites likely to attract strategically important visitors, including army, special-forces, military-equipment, chemical-industry, and political sites.
• Related DarkSword and Coruna distribution campaigns used a World Cup-themed Instagram ad, fake surveys, prize pages, and other web lures.
• Some lure sites explicitly told visitors to leave an in-app or alternative browser and reopen the link in Safari, where an iPhone exploit could be triggered.
• The article warns that some exploit kits can compromise a vulnerable device merely when a page is opened; users may not need to download an app or interact with a prompt.

Who’s being targeted

• Commonly targeted roles: All mobile-device users, Government and defense personnel, Military and special-forces personnel, Executives and other high-value personnel, Employees who use social media or in-app browsers on work devices, Web and marketing teams that manage third-party website analytics.
• Affected industries: Government and defense, Military and special forces, Chemical manufacturing, Political organizations, Mobile and web users.
• Attack channels: website.
• Impersonated: World Cup promotional advertiser, Prize promotion or online survey provider.

Awareness takeaways

• Treat unexpected prize claims, surveys, and promotional redirects as suspicious, especially when they appear after visiting an unrelated site.
• Do not follow a webpage’s instruction to switch from an in-app browser to Safari or another browser unless there is a clear business reason and the destination has been independently verified.
• Keep work mobile devices and browsers promptly updated, because simply opening a malicious page may be enough to compromise an unpatched device.
• Do not assume a familiar or legitimate-looking website is safe; compromised websites and third-party web services can deliver malicious code.

Red flags to watch for

• An advertisement or promotion asks the visitor to switch browsers.
• The page gives unusual browser-specific instructions rather than showing normal content.
• The destination is an unfamiliar domain, such as ad-track[.]live.
• An unexpected “you’ve won” claim.
• A prize or survey is presented after an unrelated web visit.
• The page redirects the visitor or pushes them to change browsers.