What happened
Between August 27 and September 3, 2026, the operators compromised the Plerdy analytics tracker at a.plerdy[.]com, causing thousands of mostly Ukrainian sites to load attacker-controlled fingerprinting code. In mid-October 2026, Sekoia identified broader activity involving compromised legitimate websites and lookalike reverse-proxy domains in the United States and Europe. Sekoia published the campaign findings on November 4, 2026 and said it was coordinating with affected-country CERTs. The delivery system fingerprinted mobile visitors and served platform-specific exploit chains without user interaction.
Published infrastructure includes america250[.]holiday, theowo[.]club, static.flux-telemetry[.]com at 109.104.106[.]107, edge-ord.clouds-stacks[.]com at 95.133.231[.]28, and ad.starx-net[.]com at 195.58.140[.]105. The iOS 16.7 cookie-theft chain used CVE-2025-43529 and CVE-2024-27834, with Sekoia assessing that the exploits could cover a wider iOS 16.0–17.4 range. The iOS 18.5 DarkSword chain used CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520 to collect extensive device data.
Android Chrome versions 139 through 145, except 143, were targeted with CVE-2026-3910 and CVE-2025-27038 to steal cookies, saved logins, browsing history and Wi-Fi passwords. The UltimateFingerprinter filename was 5b4c8fea5cbcee273e8d830f52-temfp.js, and Sekoia published SHA-256 387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c for AndroSnitch. Sekoia said additional delivery hosts, exfiltration hosts, YARA rules and compromised-site details were not published and remain restricted through its CTI service or TLP:AMBER sharing.
Why this matters now
The vulnerabilities were patched before the campaign, so the enterprise failure condition is delayed mobile updating rather than unavailable fixes. Mobile patch latency is often governed by carrier schedules, device age, employee ownership and travel constraints. Those operational exceptions become exploitable windows when attackers can fingerprint browser and operating-system versions before deciding whether to deliver a chain.
The Plerdy compromise also reframes analytics code as executable supply-chain exposure. A legitimate website can remain uncompromised at the application layer while a trusted third-party script redirects selected visitors into an exploit chain. Security leaders therefore need assurance over externally hosted JavaScript, mobile browser telemetry and session containment, rather than relying exclusively on endpoint malware persistence or traditional phishing indicators.
The decision for security leaders
Create a high-risk mobile cohort covering executives, government-facing staff, incident responders, researchers and frequent travellers. Require supported devices, accelerated patching and rapid isolation when campaign infrastructure or unexplained session reuse appears. General mobile compliance averages are insufficient when a small group carries disproportionate intelligence value.
Treat third-party JavaScript as software-supply-chain code. Web owners should identify where Plerdy or equivalent trackers execute, preserve historical dependency records and obtain assurance from providers after a compromise. Identity teams should be prepared to revoke sessions and reauthenticate users because non-persistent cookie theft can outlive the exploit process.
Evidence of closure
- MDM inventory shows supported builds on every high-risk mobile device.
- DNS and proxy logs show resolved dispositions for campaign-infrastructure contacts.
- Mobile incident review resolves every matching device or session alert.
- Third-party script inventory documents Plerdy use and current provider assurance.
The Security.io assessment
All publicly described exploit chains relied on known, patched flaws, which makes device currency the decisive control. The campaign does not demonstrate compromise of fully updated devices. It does demonstrate that state-linked operators can reuse packaged commercial-surveillance exploits and combine them with ordinary web dependencies to reach selected mobile users at scale.
Attribution posture: Sekoia assesses with moderate-to-high confidence that APT29 conducted the campaign; no government source cited here independently attributes this specific operation. The technical evidence supports treating the infrastructure and exploit activity as operationally credible while keeping actor attribution qualified. A matching domain request proves contact, not successful exploitation; device version, browser state and subsequent identity telemetry determine escalation.
Questions for the morning meeting
- Which executives, diplomats, researchers or administrators require accelerated mobile patch enforcement?
- Can mobile and network telemetry identify contact with the published infrastructure?
- Do web teams inventory third-party analytics scripts as executable supply-chain dependencies?