Hackers Turn Web Analytics Script into a Weapon

A Russian-linked group has compromised a web analytics service, turning it into a tool to deliver exploits to iOS and Android users.

According to security researchers at Sekoia, the Russian-linked hacking group known as APT29 is behind a sophisticated and widespread attack campaign. The group, also referred to as Cozy Bear, has compromised a third-party web analytics service called Plerdy SEO Tracker. By injecting malicious code into this legitimate tool, the attackers have effectively turned every website using the service into a potential distribution point for malware. This technique, known as a watering hole attack, targets visitors of trusted sites rather than attacking the sites directly. The campaign specifically focuses on delivering exploits to users browsing on both iOS and Android mobile devices, representing a significant threat to a broad user base who may be visiting otherwise secure and reputable websites.

This attack leverages a classic software supply chain vulnerability. Instead of breaching thousands of individual websites, APT29 targeted a single, widely used script provider. Once a user visits a website embedded with the compromised Plerdy script, the malicious JavaScript code executes in their browser. This initial script acts as a profiler, silently collecting detailed information about the visitor's device, browser type, and other system attributes. If the collected data matches a specific profile of interest to the attackers, the script then fetches a second-stage payload. This payload contains the actual exploit designed to compromise the visitor's iOS or Android device. This multi-stage process allows the attackers to be highly selective, making the attack harder to detect while focusing their efforts on high-value targets.

This campaign is part of a larger, troubling trend in cybersecurity where sophisticated threat actors increasingly exploit trusted relationships in the software supply chain. APT29 itself is infamous for the SolarWinds attack, one of the most significant supply chain breaches in history. While that attack targeted server-side software, this new campaign demonstrates the same strategic thinking applied to client-side JavaScript. It echoes the methods used by Magecart groups, which skim credit card data by compromising e-commerce payment scripts. By poisoning a single upstream source, attackers gain a foothold on countless downstream targets who have no direct relationship with the threat actor and implicitly trust the third-party code they embed on their sites. The focus on mobile exploits also reflects the shift of sensitive personal and corporate data to handheld devices.

For developers, CTOs, and security teams, this incident serves as a critical reminder that website security extends far beyond the code you write yourself. Every third-party script, from analytics and ad trackers to customer support chat widgets, represents a potential attack vector. Auditing these external dependencies is no longer optional. Teams should implement technical controls like Subresource Integrity (SRI), which uses a cryptographic hash to ensure a fetched script has not been tampered with. A strong Content Security Policy (CSP) can also help by restricting the domains from which scripts can be loaded. As attackers continue to target the supply chain, organizations must adopt a zero-trust mindset toward all external code and actively monitor for any signs of unauthorized modification or suspicious network activity originating from their web properties.

This campaign highlights the severe risk of third-party script dependencies. A single compromised analytics tool can turn thousands of trusted websites into distribution points for mobile exploits, bypassing traditional security measures and making every site visitor a potential target for a state-sponsored actor.

Compromised third-party scripts create significant reputational and legal risks for businesses. Websites unknowingly serving malware can lose customer trust, face potential legal action, and suffer from reduced traffic as browsers and security tools begin to block them, directly impacting revenue and brand integrity.