Plerdy · Exploitation reported

APT29 Hijacked Plerdy Tracker to Exploit Already-Patched Phone Flaws

Nov 04, 2026 · 1 min read

A cyberespionage campaign attributed by Sekoia to APT29, with moderate to high confidence, hijacked the Ukrainian analytics tracker Plerdy from August 27 to September 3 and exposed visitors of hundreds of sites to exploit chains for already-patched iOS and Android flaws, with no user interaction. Payloads stole cookies, device data and Wi-Fi passwords; Sekoia says a user running an up-to-date operating system is safe from these attacks. Immediate action: force updates on all phones.

By HIFY Radar newsroom Updated 11/04/2026 11:04 AM Get this every day →← Back to the feed 1 source

HighSupply chainExploitation reportedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An espionage group attributed to Russia (APT29, per Sekoia) hijacked the Plerdy website analytics tracker for a week and used it to attack visitors of hundreds of mostly Ukrainian sites. The attacks exploited already-patched flaws on unpatched iPhones and Androids and stole cookies, device data and Wi-Fi passwords without any user interaction.

Why it matters

No direct targeting was required: any employee with an unpatched phone who visited an affected site could have had session cookies, Wi-Fi passwords and device data stolen, and session cookies can unlock accounts without passwords. Sekoia did not say how many devices were compromised.

What to do

Force immediate updates on all corporate and BYOD phones, on iOS and Android. Revoke active sessions on critical accounts and change sensitive Wi-Fi passwords. Check whether company websites load third-party scripts such as Plerdy.

For the technical team

Affected: Plerdy, rastreador ucraniano de analytics para sites; serviço comprometido e usado como watering hole · iOS 16.7 (cookie theft); iOS 18.5 (full device data collection, via the DarkSword exploit kit); Chrome 139 to 145 on Android, excluding version 143 (browser cookies and Wi-Fi passwords).
Exploitation: Exploitation reported by Sekoia; activity uncovered in mid-October 2026 and research published November 4. Attribution to APT29 with moderate to high confidence. All flaws were n-day, already disclosed and patched; Sekoia assesses APT29 obtained the exploits from a third party.
Fix: Update iOS and Android devices; per Sekoia, a user running an up-to-date operating system is safe from these attacks. All exploited CVEs already have vendor patches.
Vector: Watering hole via three delivery routes: scripts injected into legitimate websites, lookalike domains proxying real sites while adding scripts, and the compromise of the Plerdy analytics tracker (August 27 to September 3). Visitors were fingerprinted and served device-matched exploit chains; no user interaction and no persistence established.
More details: CVEs used: CVE-2025-43529, CVE-2024-27834, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, CVE-2026-3910 and CVE-2025-27038. The DarkSword kit is suspected by Sekoia to have been developed by a commercial surveillance vendor. Exposed sites included a Ukrainian gas producer, Ukrainian military and military-equipment sites, a US chemical-industry trade association, a Czech far-right movement and a Bulgarian military-related site; lookalike domains impersonated the America250 initiative and a London hotel. A 2024 Google report described an earlier APT29 campaign on Mongolian government sites with a hardcoded filter; this one had no filter and collected any browser cookies.