Russian Hackers Turn america250[.]holiday Website Into Trap

A Russian state-linked hacking group has been using real and cloned websites as traps to quietly break into iPhones and Android devices. Analysts say visitors can lose personal data simply by opening an infected page.

Cybersecurity researchers at Sekoia identified the campaign and tied it with moderate to high confidence to APT29, a group also known as Midnight Blizzard or Cozy Bear. The attackers planted hidden code on trusted pages in the United States, Ukraine, the Czech Republic and Bulgaria, frequently targeting military and defense sectors.

To reach their targets, the hackers used three distinct entry routes. They added JavaScript directly to the main template of a Ukrainian gas production company, a US chemical industry trade group, a European far-right political party and a Bulgarian military site. When direct break-ins failed, the group registered lookalike domains, including america250[.]holiday and theowo[.]club, to act as middlemen for the real America250 site and the hotel website for Raffles London at The OWO. Visitors saw authentic content while malicious code loaded in the background.

The widest net involved a Ukrainian SEO tracker called Plerdy, which was used by thousands of sites. Attackers altered the tracker file for a week between August 27 and September 3, 2026, forcing every site loading the tracker to also load the hackers' script.

The loaded script, named UltimateFingerprinter, is hidden inside a large copy of the AngularJS library to look harmless and confuse automated analysis tools. It collects nearly 400 data fields from 61 checks while mostly blocking only odd devices that have huge screens or lack touch support.

Sekoia recovered three exploit chains. Class A targets iOS 16.7 to steal cookies, while Class C targets Android phones running specific Chrome versions to copy logins, history and Wi-Fi settings. Class B is the most invasive, targeting iOS 18.5 using a leaked exploit kit to take messages, chat databases, Keychain passwords, photos and cloud drive files. Stolen data from the campaign is sent to an external server, and none of the payloads establish lasting access, matching a pattern of quick intelligence gathering.

Fully updated phones are safe because the exploits rely on old, already-patched flaws. Analysts recommend updating iOS and Chrome immediately and replacing devices that no longer receive security updates.

Summary

A Russian state-linked hacking group turned trusted and lookalike websites into secret traps that steal data from visitors' phones just by opening a page. Because the campaign exploits already-patched flaws, keeping devices updated offers complete protection against the threat.