APT29 Watering-Hole Campaign Compromises Plerdy SEO Tracker to Target iOS and Android
Russian state-sponsored actor APT29 (Midnight Blizzard) executed a supply-chain attack by hijacking the Plerdy SEO Tracker web analytics service to launch a mobile-focused watering-hole campaign. By injecting malicious JavaScript into the hijacked script, attackers perform client-side fingerprinting to identify iOS and Android devices running unpatched n-day vulnerabilities. This drive-by exploitation enables the exfiltration of browser session cookies, stored Wi-Fi credentials, and private messages, bypassing multi-factor authentication (MFA) via session hijacking. The operation specifically targets high-value individuals in the United States, Ukraine, the Czech Republic, and Bulgaria, signaling a strategic pivot toward mobile-first espionage via trusted third-party analytics.