Supply-chain attack · high
Russia-linked hackers use watering-hole sites and a hijacked web analytics script to deliver iOS and Android exploit chains
Tier A · Patch today – Before you go home
Who’s exposed: Visitors to compromised sites and Plerdy SEO Tracker users
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Remote, no login · Supply chain
The Brief
- Russia-linked APT29 is presumed behind a watering-hole campaign targeting iOS and Android users.
- Compromised websites, fake domains and a hijacked script from Ukrainian analytics service Plerdy SEO Tracker deliver exploit chains.
- Targets are reported in Ukraine, the United States and Europe, with the aim of stealing sensitive information.
Why it matters
Developers whose sites load third-party analytics scripts can unknowingly serve exploits to visitors, and mobile users of affected sites can be compromised without any interaction.
The checklist behind the tier
Checklist · 5 of 10 yes
| Yes | Hits tech teams | Judgment: iOS and Android are OSes developers and IT teams work on; Plerdy is a SaaS script. |
| No | Core infrastructure | Judgment: iOS, Android and a single analytics vendor's script are not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: iOS and Android are mainstream, widely used platforms affected by the exploit chains. |
| Yes | Exploited in the wild | The Record: state-linked hackers targeted users in Ukraine, US and Europe in a campaign. |
| No | Public exploit | No source says exploit code or a proof-of-concept was published. |
| Yes | Remote, no login | The Record: describes the campaign as a zero-click espionage campaign. |
| No | Full takeover | Sources mention exploit chains but do not explicitly state code execution or root/admin access. |
| No | Secrets exposed | The Record says the campaign aims to steal sensitive information; no source confirms data was stolen. |
| Yes | Supply chain | The Hacker News: supply chain attack hijacked the Ukrainian Plerdy SEO Tracker web analytics script. |
| No | No fix yet | No source reports whether a patched version of iOS, Android or Plerdy is available. |
Timeline
Campaign reported by The Hacker News
The Hacker News
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
SecurityWeek
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes
The Record from Recorded Future News
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Full coverage · 3 sources
- 19h ago ↗
The Record from Recorded Future News
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - 1d ago ↗
- 2d ago ↗
First seen · 3 sources · Full story page · How tiers are decided