APT29 Exploits Compromised Web Analytics Script to Target iOS and Android Devices

APT29, a Russia-linked threat actor, conducted a watering hole attack by compromising websites and a Ukrainian web analytics service, Plerdy SEO Tracker. The injected JavaScript collects device attributes to deliver exploits targeting iOS and Android users.

The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker.

"The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and

Read original article