APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

APT29, a Russia-linked threat actor, is believed to be behind a large-scale watering hole campaign targeting iOS and Android users. The campaign involves compromised websites, fake domains, and a supply chain attack on a Ukrainian web analytics service called Plerdy SEO Tracker. The attackers have injected JavaScript code into the service, which collects browser and device attributes from targeted users. This code is used to deliver exploits to iOS and Android devices. The campaign was discovered by Sekoia researchers, including Amaury-Jacques Garçon. The attack highlights the threat actor's ability to use creative tactics to target mobile device users.