APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29 hijacks Ukrainian web analytics script to deliver iOS and Android exploits via watering hole attacks.
Russia-linked APT29 conducted a large-scale watering hole campaign targeting iOS and Android users by compromising websites and injecting malicious JavaScript into Plerdy SEO Tracker, a Ukrainian web analytics service. The injected code collects browser and device attributes to facilitate exploitation. This supply chain attack demonstrates APT29's sophisticated tactics in leveraging third-party services for widespread mobile device compromise.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Sekoia?
Get an email when a new story names Sekoia, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAPT29 compromised the Plerdy SEO Tracker, a third-party web analytics service, injecting malicious JavaScript that fingerprints and exploits iOS and Android visitors across any site using the script. This is a classic supply chain attack: by targeting one widely-used third-party component, attackers gained a multiplier effect, reaching potentially thousands of end users through trusted websites. The root cause is insufficient vetting, integrity verification, and monitoring of third-party scripts embedded in web properties. This matters because organisations often treat third-party analytics as low-risk, failing to apply the same security scrutiny they would to first-party code, creating a blind spot that sophisticated threat actors deliberately exploit.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — APT29