APT29 Watering-Hole Campaign Compromises Plerdy SEO Tracker to Target iOS and Android

Russian state-sponsored actor APT29 (Midnight Blizzard) executed a supply-chain attack by hijacking the Plerdy SEO Tracker web analytics service to launch a mobile-focused watering-hole campaign. By injecting malicious JavaScript into the hijacked script, attackers perform client-side fingerprinting to identify iOS and Android devices running unpatched n-day vulnerabilities. This drive-by exploitation enables the exfiltration of browser session cookies, stored Wi-Fi credentials, and private messages, bypassing multi-factor authentication (MFA) via session hijacking. The operation specifically targets high-value individuals in the United States, Ukraine, the Czech Republic, and Bulgaria, signaling a strategic pivot toward mobile-first espionage via trusted third-party analytics.

• Threat Actor and Attribution: APT29 (Midnight Blizzard)

  • Attributed with moderate-to-high confidence to APT29 (Cozy Bear/Midnight Blizzard) by Sekoia TDR.
  • Operation identified in mid-October 2026, signaling a strategic shift to mobile espionage.
  • Targeted high-value individuals in the United States, Ukraine, Czech Republic, and Bulgaria.

• Attack Vector: Plerdy SEO Tracker Supply Chain Intrusion

  • Hijacked the Ukrainian-based Plerdy SEO Tracker analytics script to inject malicious JavaScript.
  • Leveraged compromised legitimate websites to distribute payloads via the hijacked tracker.
  • Utilized lookalike domains and cloned websites for traffic redirection and payload staging.

• Technical Exploitation: Mobile N-Day Targeting

  • Employed client-side fingerprinting scripts to collect precise browser and device attributes.
  • Targeted mobile OS versions with known, unpatched n-day vulnerabilities to bypass modern defenses.
  • Facilitated drive-by compromises on iOS and Android devices via simple page visits.

• Impact and Data Exfiltration: Session Hijacking

  • Exfiltrated active browser session cookies to bypass multi-factor authentication (MFA).
  • Stole sensitive local data, including saved Wi-Fi passwords and private messages.
  • Leveraged stolen sessions to achieve unauthorized access to high-value user accounts.

• Defensive Actions: Mitigation and Detection

  • Audit all third-party JavaScript inclusions, specifically targeting the Plerdy SEO Tracker.
  • Enforce strict Mobile Device Management (MDM) to ensure immediate patching of mobile OS and browsers.
  • Deploy mobile EDR and browser isolation to detect unauthorized device attribute collection.
  • Block known lookalike domains and C2 infrastructure identified in the APT29 campaign.