APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

Russia-linked APT29 conducted a large-scale watering hole campaign targeting iOS and Android users. The attackers compromised websites and fake domains to deliver mobile exploits. A supply chain attack was leveraged through a Ukrainian web analytics service called Plerdy SEO Tracker. Injected JavaScript code was used to collect browser and device attributes from victims. The campaign was discovered and analyzed by Sekoia researchers Amaury-Jacques Garçon and colleagues. This operation demonstrates APT29's capability to abuse legitimate third-party services for malware distribution. The targeting of both iOS and Android platforms indicates a broad mobile threat scope. The use of watering hole tactics suggests targeted victim profiling and selective exploitation.