# SZB-f4b7ff866c: Plerdy SEO Tracker reportedly used in APT29-linked iOS and Android watering hole campaign

Sekoia researchers report that the Plerdy SEO Tracker web analytics script was compromised and used to inject JavaScript that collects browser and device attributes.

- Type: Early warning
- Kind: Malicious package
- Vendor: Plerdy
- Product: Plerdy SEO Tracker
- Status: Reported, not confirmed
- Sources: 2 distinct
- First seen: 2026-11-04 14:44 UTC

> No statement or filing from Plerdy has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

Sekoia researchers report that the Plerdy SEO Tracker web analytics script was compromised and used to inject JavaScript that collects browser and device attributes. The campaign is said to be linked to the Russia-linked threat actor APT29 and also uses compromised websites and fake domains.

## What to do

- Check websites for the Plerdy SEO Tracker script and remove it if it is not needed
- Review pages for unexpected or injected JavaScript
- Block known campaign domains identified in the Sekoia report
- Monitor site visitor traffic and logs for unusual device fingerprinting activity

## Timeline

- 2026-11-04 14:27 UTC: Made public by The Hacker News
- 2026-11-04 14:44 UTC: First seen by cve.now

## Evidence (2 sources)

- 2026-11-04 · Press · [The Hacker News](https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html): “The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker.”
- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@cyberseckyle/117559414283805866): “Sekoia reports mobile watering holes using hacked websites, lookalikes and a compromised Plerdy analytics script (Aug 27–Sep 3).”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f4b7ff866c&body=https%3A%2F%2Fcve.now%2FSZB-f4b7ff866c%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-f4b7ff866c

### Has Plerdy confirmed it?

The Hacker News and Mastodon report it. No statement from Plerdy has reached cve.now yet.

Source: https://thehackernews.com/2026/11/apt29-linked-hackers-hijack-web.html, https://infosec.exchange/@cyberseckyle/117559414283805866

### What should Plerdy users do?

Check websites for the Plerdy SEO Tracker script and remove it if it is not needed. Review pages for unexpected or injected JavaScript. Block known campaign domains identified in the Sekoia report. Monitor site visitor traffic and logs for unusual device fingerprinting activity.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-f4b7ff866c
Site guide for agents: https://cve.now/llms.txt