What Happened
A large-scale Plerdy SEO Tracker watering hole campaign is reportedly linked to APT29, a Russia-linked threat actor. The campaign targets iOS and Android users through compromised websites, fake domains, and a supply chain attack involving Plerdy SEO Tracker, a Ukrainian web analytics service. Sekoia researchers say the injected JavaScript code collects browser and device attributes.
This is not a typical malware blast. A watering hole attack works by planting malicious code on sites that the intended victims are likely to visit. In this case, the analytics script is the part of the page that gets modified, which means the malicious code can run in the context of otherwise trusted websites.
Timeline
No timeline for this campaign has been published yet. The report from The Hacker News appeared on Nov 4, 2026.
Who Is Affected
The direct targets are people browsing on iOS and Android devices. That includes employees, clients, and anyone else who visits a compromised site while on a phone or tablet.
Websites that use Plerdy SEO Tracker are the other side of the story. Because the attack involves a supply chain compromise of the analytics script, any site that loads that script could be serving the malicious code to its visitors. The reporting does not say which sites or how many were affected.
What This Means for MSPs
For MSPs, this campaign matters for two reasons. First, your clients' mobile devices are endpoints you may not fully control. Second, the websites you manage or monitor often run third-party scripts, and those scripts are part of the attack surface.
A watering hole attack does not require the victim to click a malicious link. The victim just has to visit a page that has been compromised. That makes it harder to explain to clients, because the usual advice about not clicking links is not enough.
The supply chain angle is just as important. When a trusted service like an analytics tool is compromised, the line between 'safe' and 'unsafe' gets blurry. As a standing practice, treat third-party scripts on client sites as code you need to review, not as black boxes.
Technical Details: Plerdy SEO Tracker Watering Hole
The available reporting names no CVE identifier and no specific product version. The campaign is described as a large-scale watering hole attack targeting iOS and Android users.
The attack vector combines compromised websites, fake domains, and a supply chain attack involving Ukrainian web analytics service Plerdy SEO Tracker. Sekoia researchers say the injected JavaScript code collects browser and device attributes. No further technical details about the exploit chain have been published in the available reporting.
What to Do This Week
Work through these steps this week. They are general precautions, but they map directly to this campaign.
- Check your own website and every client site you manage for the Plerdy SEO Tracker script. You need to know which sites load it before you can decide what to do next.
- Look at any third-party JavaScript on those sites. If a script has changed recently, is obfuscated, or is loading from an unexpected domain, treat it as suspicious.
- Verify that analytics scripts are loaded over HTTPS from the expected domain. Redirects, mixed content, or extra requests are worth investigating.
- Make sure iOS and Android devices that access business systems are updated. Mobile browsers are the target here, and patches are the baseline defense.
- Consider web filtering or browser isolation for users who browse from managed devices. That gives you a layer of protection against sites that have been quietly compromised.
- Watch for updated guidance from Sekoia and Plerdy. If you have a vendor relationship with Plerdy, ask whether they have published a security notice or a fix.
What to Tell Clients
Security researchers have reported a watering hole campaign that may be linked to APT29. It targets iOS and Android users and appears to involve the Plerdy SEO Tracker analytics script.
If your website uses Plerdy, we are reviewing the site for signs of tampering. We are also checking other third-party scripts as a precaution.
Please keep your phone and tablet software up to date. If you use a personal device for work, treat unexpected pop-ups, login prompts, or install requests with suspicion.
Frequently Asked Questions
What Is a Watering Hole Attack?
A watering hole attack is when attackers compromise a website that a specific group of people is likely to visit. The goal is to deliver malware or exploits to those visitors. This campaign uses compromised websites and a hijacked analytics script to target iOS and Android users.
What Is APT29?
APT29 is the Russia-linked threat actor named in the reporting. The campaign is said to be linked to APT29, so the attribution comes from researchers and press, not from a confirmed government statement.
How Did the Plerdy SEO Tracker Script Get Hijacked?
The reporting describes a supply chain attack involving Plerdy SEO Tracker, a Ukrainian web analytics service. Sekoia researchers say the injected JavaScript code collects browser and device attributes. The available reporting does not include the full technical details of how the script was modified.
Should I Remove Plerdy SEO Tracker From My Website?
If your site loads the Plerdy script, treating it as potentially compromised is reasonable until more details are published. Check whether the script is loading from the expected source and look for changes or unusual requests. Removing the script temporarily is a low-risk precaution, but you should also review the rest of your third-party scripts.
How Can I Tell If My Website Was Affected?
Look for unexpected changes to the Plerdy script, extra network requests, or mobile visitors reporting pop-ups and redirects. Review your web server logs for odd traffic patterns and check whether any files were modified around the time the campaign began. If you do not have the expertise in-house, ask your MSP or a security professional to review.
What Should I Do About iOS and Android Devices in My Business?
Treat them like any other endpoint. Keep them patched, restrict sideloading and unknown profiles, and use web filtering if you can. If users access business email or apps from personal devices, encourage them to update promptly and report anything unusual.
Sources
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android ExploitsHackernews · Reported
- APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android ExploitsHackernews · Reported