SVR-linked actors proxy america250.holiday and theowo.club to deploy patched iOS/Android payloads

The operation used reverse proxies to inject profiling scripts into traffic from at least two high-profile domains. One mirrored the America 250 anniversary site; the second mirrored the OWO hotel near UK government buildings. Payloads targeted both iOS and Android, attempting cookie theft, Wi-Fi credential extraction, and full device data access on unpatched or recently patched versions.

Sekoia attribution rests on infrastructure overlaps and targeting patterns consistent with prior SVR activity against Ukrainian-linked entities. Data from the incidents shows selective execution only after device fingerprinting succeeded, limiting noisy infections. This matches documented SVR preference for low-volume, high-value collection rather than mass deployment.

Compromised devices expose calendar, contacts, and authentication tokens that directly affect corporate email and VPN access, creating immediate job-security exposure for any user whose phone holds work credentials. The 12-month window remains open because many patched flaws retain secondary exploitation paths through supply-chain or configuration drift.

Operational response requires mandatory browser isolation for government-adjacent domains and rapid revocation of session tokens on any suspected mobile endpoint. Continued use of the same proxy technique on new domains is the measurable indicator of persistence.