Mmastodon TechnologyCybersecurity first seen 3 d ago, last 3 d ago, peak #12

APT29-linked attack poisons Plerdy SEO tracker

Original: 🤖 APT29-linked "Poisoned Source": supply-chain compromise of Plerdy SEO Tracker injects JS into thousands of sites, prof

A supply-chain compromise of the Plerdy SEO analytics tool reportedly injected malicious JavaScript into thousands of websites. The code profiles each visitor and delivers mobile exploits: iOS visitors receive 'DarkSword', harvesting cookies and device data, while Android users get 'AndroSnitch', targeting Chrome and Wi-Fi credentials. Researchers at Sekoia link the campaign to APT29, the Russian state-aligned hacking group, prompting renewed warnings about third-party script risks.

Why now: A widely used analytics tool was weaponised against visitors of thousands of sites, raising fresh supply-chain security concerns.

APT29PlerdySekoiaDarkSwordAndroSnitch

Open on mastodon →

Evidence

• 🤖 APT29-linked "Poisoned Source": supply-chain compromise of Plerdy SEO Tracker injects JS into thousands of sites, profiles each visitor, then serves N-day mobile exploits. iOS gets DarkSword (cookies, device data), Android gets AndroSnitch (Chrome, Wi-Fi creds). Sekoia… · cloud@infosec.exchange

API: https://socialmediatrends-api.osmike.com/v1/trends/4930422