APT29 Exploits Web Analytics Platform to Target Mobile Devices in Global Watering‑Hole Campaign

A sophisticated Russian‑linked hacking group identified as APT29 has been linked to a widespread watering‑hole operation that injects malicious code into mobile devices running iOS and Android. The campaign leverages a compromised web‑analytics service, Plerdy SEO Tracker, to deliver exploit payloads to visitors of infected sites, including legitimate domains and counterfeit copies of popular webpages.

Security researchers discovered that the attackers first infiltrated the Ukrainian‑based analytics provider’s infrastructure, inserting a malicious JavaScript snippet into the tracking script distributed to client websites. When a user’s browser loads the tainted script, the code silently checks the visitor’s operating system and, if a mobile platform is detected, redirects the request to a secondary server that hosts tailored exploits for iOS or Android. The malicious payloads are designed to bypass standard security measures and gain persistent access to the compromised device.

In addition to the supply‑chain compromise, the group employed classic watering‑hole tactics by hijacking legitimate domains and creating look‑alike sites that appear in search results. These sites embed the same malicious analytics script, expanding the reach of the operation beyond the direct customers of Plerdy. Analysts estimate that thousands of mobile users may have been exposed, although the exact number of successful infections remains unclear.

The targeting of mobile platforms marks a notable shift for APT29, which has historically focused on espionage‑oriented attacks against government and corporate networks. By moving into the mobile space, the group can potentially harvest a broader range of data, including messaging, location, and authentication tokens. This development aligns with a growing trend among nation‑state actors to exploit the increasingly interconnected nature of personal devices.

Experts warn that users should update their operating systems and applications promptly, as many of the exploits rely on known vulnerabilities that have been patched in recent releases. Organizations using third‑party analytics tools are urged to audit the integrity of the scripts they serve and consider implementing subresource integrity checks. The incident also underscores the importance of supply‑chain security, prompting calls for stricter oversight of software components that traverse international borders. Law enforcement agencies in the United States and Europe have been notified, and further investigations are expected to trace the full extent of the campaign and identify additional compromised parties.