Plerdy Tracker Hack: How APT29 Turned an Analytics Script Into a Watering Hole, and How to Check the Third-Party Scripts on Your Website

For one week this summer, someone changed a website analytics script used by thousands of sites. Every visitor's phone was quietly checked, and out-of-date ones could be attacked. Researchers at Sekoia say the work was done by APT29, a Russian state hacking group. The lesson for any business with a website is simple: every outside script on your pages has the same power as your own code, so if that vendor is breached, the attack comes from your site.

The phone side of this campaign is in our earlier post on the zero-click watering hole attacks. This post covers the website side: how the Plerdy script was used, who carried the risk, and what to check on your own site this week.

What happened to the Plerdy tracker

Sekoia published its report, "Poisoned Source", on November 4, 2026, and says its team found the campaign in mid-October. Plerdy is a Ukrainian website analytics service. Its tracking script loads from a.plerdy[.]com.

Sekoia found that between August 27 and September 3, 2026, attackers changed the tracker's main.js file. Visitors to any site using Plerdy loaded the normal tracker and also a hidden fingerprinting script. That script collected browser and device details and sent them to an attacker server, which then chose one of three exploit chains for the visitor's phone.

Sekoia says the tracker is loaded by thousands of websites, most of them Ukrainian, including army, special forces and military equipment sites.

What is confirmed, what is claimed, and what is not known

Was Plerdy the only way in?

No. Sekoia describes three routes:

• Code injected straight into websites, including those of a Ukrainian gas production company, a major US chemical industry trade association, a Bulgarian military-related site and an Australian medical clinic.
• Lookalike sites that showed a real site's content and added the attack script. Copies of America250.org and a London hotel's site were both used.
• The Plerdy supply chain compromise.

Website owners should study the Plerdy route most closely. The sites that loaded it were not hacked themselves. Their only mistake was trusting a vendor's script.

Which phones were at risk

Sekoia's report lists three exploit chains:

Sekoia states that "a user running an up-to-date operating system is safe from these attacks." Apple's iOS 18.7.3 security notes, released December 12, 2025, list the fix for CVE-2025-43529. That WebKit flaw is the first step in both iPhone chains, and Apple noted at the time that it may have been exploited. For Android, Sekoia does not give a fixed Chrome version and we have not confirmed one ourselves. The safe instruction is to install the latest Chrome from Google Play and the latest system update.

Why a hacked analytics script matters for a business website

• An outside script has full control of the page. It can read what visitors type, change what they see and load more code. The browser treats it the same as your own code.
• Your site becomes the delivery point. Visitors came because they trust your name, and the attack uses that trust.
• You may never notice. The change happened on the vendor's server, so your own files and logs show nothing new.
• Nobody owns these scripts. Heatmap, chat, analytics and testing tags are often added by marketing staff or an agency years ago, and nobody reviews them. That is the same gap we wrote about in who is patching the software that runs your business.

If your site runs on a plugin-heavy platform, every plugin that adds a script is part of this chain too. See why WordPress sites get hacked.

How to check the third-party scripts on your website this week

Two limits to know. Subresource Integrity breaks whenever the file changes, including legitimate updates. For a tracker the vendor updates in place, you would have to host and pin your own copy. A Content Security Policy cannot stop bad code served from a domain you have already allowed.

Plerdy and APT29 questions people are asking

Was Plerdy hacked?

Sekoia says the Plerdy tracker at a.plerdy[.]com was compromised for one week, August 27 to September 3, 2026. We found no public statement from Plerdy.

Is the attack still running?

Sekoia says it is working with national computer emergency teams to identify victims and disrupt the infrastructure. It does not say the whole campaign has stopped. It notes that the London hotel lookalike is offline.

Can a website infect a phone without a click?

On the vulnerable versions, yes. Visiting the page was enough. Sekoia says fully updated phones are safe.

Does my website have to be hacked to be used in an attack like this?

No. Sites that loaded the Plerdy script were not breached themselves. The vendor's file was changed.

Would Subresource Integrity have stopped it?

Only for a site that loaded a fixed, hashed copy of the script. The browser blocks any file whose hash does not match, so the changed file would not have run.

What is APT29?

A Russian state hacking group that Sekoia links to the SVR intelligence service. It is also known as Midnight Blizzard, Cozy Bear and The Dukes.

The bigger lesson

Every script on your site that you did not write depends on someone else's security. That is fine as long as you know which scripts they are, why each one is there, and what limits stop them from loading anything else. Keep the list short, pin what you can, and treat each new marketing tag as a change that needs approval.

For help reviewing and locking down your site, see security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Sekoia, Poisoned Source: APT29 watering holes target mobile devices with n-day exploits; Apple, About the security content of iOS 18.7.3; MDN, Subresource Integrity; MDN, Content Security Policy.