Threat watch / Campaign
Plerdy analytics script hijacked to serve phone exploits
Code injected into a Ukrainian analytics tracker, loaded by thousands of sites, fingerprinted visitors' phones and served iOS and Android exploit chains for flaws that were already patched.
- Sector
- Many sectors
- Way in
- Supplier
- Product or vendor
- Plerdy
- How it happened
- Code injected into Plerdy's tracker script between August 27 and September 3, 2026. Visitors' phones were fingerprinted, then served exploit chains that rely only on known, already patched flaws. How Plerdy itself was compromised is not public.[1][2] Checked 7 Nov 2026
- What was stolen
- Sekoia says the final payloads take cookies or full device data from iPhones, and Chrome data and Wi-Fi passwords from Android phones. What was taken from Plerdy's visitors specifically is not public.[1] Checked 7 Nov 2026
- Who was impacted
- Visitors of the thousands of sites loading the tracker, mostly Ukrainian, including army, special forces and military equipment sites. Other compromised sites include a Ukrainian gas producer, a US chemical trade association and a Bulgarian military-related site.[1][3] Checked 7 Nov 2026
- Threat actor
- APT29 →
- CVE
- CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910, CVE-2025-27038
Timeline
- Between August 27 and September 3, attackers inject code into Plerdy's tracker, loaded by thousands of websites, mostly Ukrainian. [1][2]
- Sekoia publishes "Poisoned Source" and attributes the campaign to APT29 with moderate to high confidence. None of the chains uses a zero-day. [1]
- BleepingComputer lists other compromised sites in Ukraine, the US and Bulgaria. [3]
- CISA adds CVE-2024-27834, the Apple pointer authentication bypass used in Sekoia's iOS 16.7 chain, to its catalog of known exploited flaws. US federal agencies must patch by November 18, 2026. [1][4]