Russian state-backed APT29 has been linked to a large-scale watering-hole campaign that compromised legitimate websites, registered lookalike domains (including "america250[.]holiday") and ran a supply-chain attack against Plerdy SEO Tracker, a Ukrainian web-analytics service, between 27 August and 3 September 2026 by injecting malicious code into the analytics script "a.plerdy[.]com/public/js/click/main.js", according to French security firm Sekoia. The injected JavaScript profiles the visitor's browser and device, then a delivery infrastructure serves platform-specific N-day exploit chains against iOS or Android, with payloads capable of stealing browser cookies and, in some cases, Wi-Fi passwords or full device data. Compromised sites included a major US chemical-industry trade association, a far-right European political party and a Bulgarian military-related website — a target set Sekoia says suggests the campaign was aimed at specific high-value individuals connected to the Russia–Ukraine war. Discovered in mid-October 2026, the campaign is evidence of espionage actors commercialising third-party analytics as an initial compromise vector.

• Source article