APT29 hijacks web analytics script to deliver iOS and Android exploits
Original title: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29 uses Plerdy SEO Tracker supply chain compromise to serve n-day exploits stealing cookies and device data from iOS and Android users in 2026.
The Russia-linked threat actor APT29 is behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. The activity codenamed Poisoned Source was discovered by Sekoia in mid-October 2026. The end goal is to serve payloads capable of stealing browser cookies, and in some cases Wi-Fi passwords or full mobile device data.
Unconfirmed: Low confidence in some site targeting intentions.
- Three infection vectors: website compromise, lookalike domains, Plerdy supply chain.
- iOS Class A uses CVE-2025-43529 and CVE-2024-27834.
- iOS Class B uses DarkSword with multiple CVEs.
- Android uses CVE-2026-3910 and CVE-2025-27038.
- No persistence; data exfiltrated to ad.starx-net[.]com.
Impact: cookie theft and device data exfiltration
- 1.Upgrade to up-to-date iOS and Android versions.
- CVEs
- CVE-2025-43529CVE-2024-27834CVE-2026-20700CVE-2025-14174CVE-2025-43510CVE-2025-43520CVE-2026-3910CVE-2025-27038
- Vendors
- Sekoia
- Threat actors
- APT29
- Organizations
- PlerdyUkrainian army websites
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
| CVE-2025-14174 | Out of Bounds Memory Access in Google Chromium ANGLE Affects Chrome, Edge, Opera | 8.8 | 55% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
CVE-2025-43510+1 related CVE | Improper Locking Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 group max | <1% | KEV | KEV |
| CVE-2025-43529 | Use-After-Free in Apple WebKit (Safari, iOS, macOS) Allows Arbitrary Code Execution | 8.8 | 26% | KEV | KEV |
| CVE-2026-20700 | Exploited Memory Corruption Flaw in Apple iOS, iPadOS, macOS, tvOS, visionOS, watchOS | 7.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ad-track.live | s Instagram ad themed around the World Cup and served from "ad-track[.]live." The other pathway is part of a criminal campaign dubbed |
| domain | america250.holiday | e sites masquerading as high-profile websites in the U.S. ("america250[.]holiday"), Ukraine, Czech Republic, and Bulgaria Supply chain com |
| domain | plerdy.com | and September 3, 2026, by injecting malicious code into "a.plerdy[.]com/public/js/click/main.js" Some of the compromised websites |
| domain | starx-net.com | In all three cases, the exfiltrated data is sent to the "ad.starx-net[.]com:8881/telemetry/v12" endpoint. The Android attack chain in |
From the original article
5 min read at thehackernews.com
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.