Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-f4b7ff866cEarly warningMalicious packageReported, not confirmed

Plerdy SEO Tracker reportedly used in APT29-linked iOS and Android watering hole campaign

Sekoia researchers report that the Plerdy SEO Tracker web analytics script was compromised and used to inject JavaScript that collects browser and device attributes.

Written by a model from the sources below. Verify against them.

Sources2Reported, not confirmed
Kind
Malicious package
Vendor
Plerdy
Product
Plerdy SEO Tracker
Status
Reported, not confirmed
First seen

Summary

Sekoia researchers report that the Plerdy SEO Tracker web analytics script was compromised and used to inject JavaScript that collects browser and device attributes. The campaign is said to be linked to the Russia-linked threat actor APT29 and also uses compromised websites and fake domains.

What to do

  • Check websites for the Plerdy SEO Tracker script and remove it if it is not needed

  • Review pages for unexpected or injected JavaScript

  • Block known campaign domains identified in the Sekoia report

  • Monitor site visitor traffic and logs for unusual device fingerprinting activity

Timeline

  1. Made public by The Hacker News
  2. First seen by cve.now

Evidence 2

  1. Press
    The Hacker News
    “The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker.”
  2. Social
    Mastodon
    “Sekoia reports mobile watering holes using hacked websites, lookalikes and a compromised Plerdy analytics script (Aug 27–Sep 3).”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-f4b7ff866c

Has Plerdy confirmed it?

The Hacker News and Mastodon report it. No statement from Plerdy has reached cve.now yet.Source: The Hacker News, Mastodon

What should Plerdy users do?

Check websites for the Plerdy SEO Tracker script and remove it if it is not needed. Review pages for unexpected or injected JavaScript. Block known campaign domains identified in the Sekoia report. Monitor site visitor traffic and logs for unusual device fingerprinting activity.

Sources