APT29 Hacked Ukrainian Service Plerdy: How Analytics Was Used to Attack iPhone and Android

In mid-October 2026, French company Sekoia (Threat Detection & Research) uncovered a large-scale campaign it named Poisoned Source. Its goal is to steal data from mobile devices without any user interaction: a person only needed to open an infected page in a browser. The report was published on November 4, 2026.

Per Sekoia's assessment, with moderate-to-high confidence the campaign was run by APT29 (also known as Midnight Blizzard, Cozy Bear, or The Dukes), which is linked to Russia's Foreign Intelligence Service (SVR). This is an experienced espionage group known for targeted attacks on government bodies and diplomacy. In August 2026, Microsoft reported that Midnight Blizzard had been intercepting Wi-Fi in hotels and conference centers for months to steal Microsoft 365 credentials.

For the Ukrainian audience this story is especially painful: one of the three attack vectors was the hack of the Ukrainian web-analytics service Plerdy, whose tracker is loaded by thousands of mostly Ukrainian sites — including some linked to the defense sector.

Three infection paths

The campaign used three independent vectors, all leading to the same result:

1. Direct JavaScript injection into hacked sites. Legitimate resources in the US, Ukraine, Czechia, and Bulgaria were attacked — victims included a US chemical-industry trade association, a European political party, and a site linked to the Bulgarian military.
2. Clones of popular sites. Attackers created domains imitating well-known resources (including america250[.]holiday and a copy of the Raffles London at The OWO hotel site) and intercepted visitors searching for the real pages. This is the Adversary-in-the-Middle approach, where the victim believes they are on the official site.
3. Hack of the Plerdy SEO Tracker. For a week — from August 27 to September 3, 2026 — the group controlled the analytics tracker connected to thousands of sites, most of them Ukrainian.

In all three cases the final code was the same: a JavaScript loader that "fingerprints" the visitor's device and browser, then sends this data to an exploit-delivery server. That server, in turn, selects a specific exploit chain for the device — separately for iOS and Android.

The Plerdy hack: a week when analytics became a weapon

Plerdy is a Ukrainian service that gives site owners analytics tools: heatmaps, session recordings, SEO analysis. Its tracker is embedded across a huge number of pages, which is exactly what made it an attractive supply-chain target.

According to Sekoia, the attackers injected malicious code into the legitimate tracker file a.plerdy[.]com/public/js/click/main.js. Because of this, everyone who opened a site with Plerdy connected received the attacker's code in parallel with the original script. Researchers present a sanitized fragment of the injected code: it created a <script> tag in the page that loaded a fingerprinting script from the third-party domain edge-ord.clouds-stacks[.]com.

Interestingly, that domain didn't store the final script — via HTTP redirects it forwarded requests to other delivery servers: ads-it-assets[.]com, cdn.adv-static[.]com, wpvortex-mod[.]com, assets-int[.]com. The group called its fingerprinting script UltimateFingerprinter, and final data collection happened through ad.starx-net[.]com. Such a branched infrastructure complicates blocking and allows quickly swapping compromised nodes.

For a week, the exploit kit was available through Plerdy to visitors of hundreds of legitimate sites. Among them — resources linked to the army, special-operations forces, and military-equipment manufacturers (ballistics, drones). Researchers also found the same fingerprinting file on a Ukrainian gas-production company's site. This directly points to the intelligence nature of the operation and its targeting of Ukraine's defense and strategic sectors in the context of the war.

Technical breakdown: three exploit chains

Sekoia obtained three complete exploit chains (labeled A, B, and C) that the delivery server handed out depending on the OS and browser version:

• Chain A — iOS 16.7. Uses CVE-2025-43529 and CVE-2024-27834 to steal Safari cookies. This is the simplest of the three attacks; its goal is to hijack the user's active sessions.
• Chain B — iOS 18.5. The full DarkSword exploit kit with five vulnerabilities: CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. The result is a nearly full copy of the device. The payload extracts SMS and iMessage from sms.db, mail indexes (Envelope Index and Protected Index), voicemail, WhatsApp and Telegram databases, Keychain passwords and tokens, accounts from Accounts3.sqlite, Wi-Fi passwords from wifi_passwords.txt, contacts, call history, calendar and notes, Safari history and cookies, plus Apple Health data, location caches, the photo library, and iCloud Drive.
• Chain C — Android, Chrome 139–145 (except 143). Uses CVE-2026-3910 and CVE-2025-27038 for code execution, sandbox escape, and privilege escalation, then loads a malicious module Sekoia named AndroSnitch. It collects Chrome cookies, logins, browser history, and saved Wi-Fi passwords.

DarkSword is an iOS exploit kit that, per researchers' assessment, was created by a commercial spyware vendor; it was uploaded to VirusTotal back in September 2026. This is an alarming trend: tools once available only to states through private "surveillance vendors" are now leaking into open repositories and being reused by other groups. In other words, intelligence operations are increasingly built not on in-house development but on secondary use of ready-made exploits. The Android chain has an unusual detail — a "switch": if the device identifier equals SM-S938B (Samsung Galaxy S25 Ultra), exploitation stops. Sekoia doesn't explain the reason for this exception. Notably, after data collection the malicious code doesn't persist in the system — no persistence, just one-time collection and sending.

n-day, not zero-day: why it matters

A key feature of the campaign: it contains no zero-day vulnerability. All the holes used had already been patched by vendors before the attacks began. These are so-called n-days — known, already-closed vulnerabilities that only work against devices that weren't updated.

A telling example is CVE-2024-27834, an iOS pointer-authentication bypass that Apple patched back in May 2024. Only now, after Sekoia's report, did CISA add it to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of November 18, 2026.

Hence the main conclusion researchers emphasize: a user with an up-to-date OS version is protected from these attacks. The campaign "catches" exactly outdated, non-updated phones and tablets, so those who postpone updates for months remain exposed.

Campaign timeline

To understand the scale, it's useful to look at the sequence of events:

• May 2024 — Apple fixes CVE-2024-27834, a pointer-authentication bypass. This vulnerability becomes part of the iOS 16.7 chain.
• August 27 – September 3, 2026 — APT29 controls the Plerdy tracker (a.plerdy[.]com), and the malicious code is seen by visitors of thousands of sites.
• September 2026 — the DarkSword iOS exploit kit appears on VirusTotal.
• Mid-October 2026 — Sekoia begins its investigation and uncovers the campaign.
• November 4, 2026 — report published; CISA adds CVE-2024-27834 to KEV with a November 18, 2026 deadline.

This timeline illustrates the core idea well: more than two years can pass between a vulnerability's fix and its active exploitation. Those who didn't update remained vulnerable the whole time.

Why this is especially dangerous for Ukraine

It's not just that the compromised service is Ukrainian. The attack hit sites visited by military personnel, defense-industry specialists, and people working with sensitive information. Stealing cookies, passwords, and tokens lets an attacker reuse others' sessions — i.e., log into the victim's accounts, including webmail, without entering a password.

This is a classic intelligence-group technique: don't storm the defenses "head-on," but wait until the victim visits a convenient page. The scale through Plerdy gave attackers a wide "net" that caught even those who didn't visit the targeted sites. Sekoia is already coordinating with the national CERTs of affected countries to identify victims and dismantle the infrastructure.

How to protect yourself and your organization

1. Update your OS and browser. This is the main and only reliable defense against n-day attacks. Enable automatic updates for iOS/Android and Chrome.
2. Check whether your credentials leaked. If you visited sites with Plerdy connected between August 27 and September 3, 2026, change passwords and reset active sessions. You can quickly check whether your data appeared in leaks via our breach-check tool.
3. For site owners — inventory third-party scripts. Make a list of all trackers and libraries your site loads. This is the same supply-chain risk the attackers used.
4. Monitor third-party script integrity. Use Subresource Integrity (SRI) for external resources and monitor changes to analytics files.
5. Raise team awareness. Basic understanding of how such attacks work significantly lowers risk — start with our "Cybersecurity: learning" material.
6. For organizations — manage the device fleet. If employees use work phones, deploy an MDM solution that controls OS versions and blocks connecting to corporate resources from outdated devices. This especially concerns people working with sensitive information — exactly who such campaigns target.

Conclusion

The Poisoned Source campaign is a vivid reminder that hacking one analytics provider can put visitors of thousands of sites at risk simultaneously. For Ukraine this is another signal: intelligence groups are actively hunting mobile devices and using even ordinary web-analytics tools for this purpose.

At the same time, the good news is that none of the vulnerabilities used was unknown. Defense is regular system and browser updates — and for site owners, control over third-party code. If your device is updated, you are protected from these specific attacks.

The campaign's broader lesson goes beyond mobile devices. Third parties — analytics, ad trackers, support chats, CDNs — are part of almost every modern site, yet rarely seen as a full risk zone. Poisoned Source shows that even a small analytics script can become an entry point for an intelligence operation. Therefore, vendor risk management and constant auditing of what actually runs in your visitors' browsers are no longer an option but a basic requirement for any organization working with sensitive data.