APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

A threat group linked to Russia's APT29 has reportedly turned a trusted web analytics script into a delivery channel for iOS and Android Exploits. According to the report, the attackers used compromised websites and the Plerdy analytics service to steal browser and device data from visitors. The campaign shows how a single trusted third-party component can become a route to many victims at once.

How the Attack Reportedly Unfolded Across Websites

The attackers are said to have compromised legitimate websites and tampered with the way those sites loaded analytics code. Because analytics scripts run on nearly every page and are rarely questioned, malicious code placed in them can reach visitors without raising immediate suspicion.

Once the altered script ran in a visitor's browser, it was designed to check the visitor's device and browser. The goal appears to have been to find mobile users running vulnerable software, which is where the iOS and Android exploits come in.

This kind of selective targeting is a hallmark of sophisticated operations. Instead of infecting everyone, the code can choose which visitors to attack, which lowers the chance of detection by security researchers.

Why Web Analytics Scripts Are Attractive Targets

Analytics and marketing scripts are loaded from third-party servers and granted broad access to page content. If an attacker controls or modifies such a script, they gain a position inside every site that embeds it, without breaking into each site separately.

Website owners often treat these scripts as low-risk, so they may not review them as closely as their own code. Security tools can also overlook them, since the requests come from a familiar and reputable service.

This is a classic supply chain problem. Trust placed in one vendor is passed on to every customer, so one weak point can expose many organizations and their visitors.

The Role of Plerdy in the Campaign

The report points to Plerdy, a web analytics and conversion optimization service, as the component abused in the attack. It is not yet clear from the description how the attackers gained the ability to influence the script, and the possible routes include compromising the vendor's infrastructure or the sites that embed it.

Readers should be careful not to assume the service itself was knowingly involved. In incidents like this, the vendor is typically a vehicle rather than a participant, and the exact failure point often emerges only after a full investigation.

Website operators using any analytics provider should watch for official advisories and verify the integrity of the scripts they load. Checking vendor statements and indicators of compromise is a sensible first step.

Understanding the iOS and Android Exploit Delivery

The central concern is that the campaign reportedly delivered exploits for both Apple and Android devices. Mobile browsers are an appealing target because people use them constantly and store sensitive information on their phones.

Exploits of this type usually take advantage of flaws in the browser engine or related components. A visit to an infected page can be enough to trigger them, with no click or download required from the victim.

The description says the exploits were used to steal browser and device data. That could include information such as stored sessions, credentials, or details that help identify and track a target, though specific data types should be confirmed against the original reporting.

What Is Known About the APT29 Connection

APT29 is widely associated with Russian intelligence and is also tracked under names such as Cozy Bear and Midnight Blizzard. The group has a long record of espionage against governments, diplomatic bodies, and technology companies.

Researchers have previously linked APT29 to watering hole attacks, where trusted websites are compromised to deliver exploits to visitors. The reported use of mobile exploits through a compromised script fits that pattern, though attribution in cyber operations is often made with varying levels of confidence.

The "linked" wording in the headline matters. It suggests the activity shares tactics, infrastructure, or tooling with APT29 rather than being definitively proven to be the group's work.

Potential Impact on Organizations and Individuals

For individuals, the main risk is the quiet theft of data from a phone or browser. Because the attack can occur just by visiting a compromised site, victims may never see a warning sign.

For organizations, the danger extends beyond employees' devices. Stolen browser data can include session tokens or credentials that open the door to corporate email, cloud services, and internal tools.

Website owners also face reputational and legal consequences if their pages are used to attack visitors. Even if they were victims themselves, they may need to notify users and investigate how the script was tampered with.

Steps Defenders Can Take Right Now

The most effective protection against exploits like these is keeping operating systems and browsers fully updated on both iOS and Android. Patches close the Vulnerabilities these attacks depend on, so delays leave devices exposed.

Website owners should audit every third-party script on their pages and remove those that are not essential. Controls such as Content Security Policy and Subresource Integrity can help detect or block unexpected changes to externally loaded code.

High-risk users, such as journalists, officials, and activists, should consider enabling stricter device protections, such as Lockdown Mode on iPhone. Security teams should also monitor for unusual outbound connections from analytics-related domains.

Broader Lessons for Supply Chain Security

This incident reinforces that attackers keep targeting the weakest link in the web ecosystem rather than the strongest defenses. A trusted script can bypass many of the protections organizations have built around their own code.

Going forward, companies should treat third-party scripts as part of their attack surface and apply the same scrutiny they give to software dependencies. Vendor risk reviews, change monitoring, and minimizing the number of external scripts all reduce exposure.

As more details emerge from researchers and the affected parties, the picture of this campaign will likely become clearer. Readers should consult the original reporting and official advisories for confirmed technical specifics before acting on any single account.

If you have any questions, please don't hesitate to Contact Us