Threats & Adversaries · APT / Espionage
APT29 used analytics code to reach hundreds of sites Sekoia uncovered in mid-October 2026 a campaign it attributes with moderate-to-high confidence to APT29 : a compromised Ukrainian analytics service exposed visitors across hundreds of legitimate sites to exploit delivery for one week. The campaign also used directly compromised websites and attacker-controlled lookalike domains.
The analytics script ran in visitors’ browsers, profiled their device and browser, then sent them to a delivery server that selected a matching exploit—no click required. Sekoia says the payloads stole cookies or full device data from iOS devices, and Chrome data and Wi-Fi passwords from Android devices, without leaving a persistent implant.
For organizations whose sites loaded that supplier, the exposure reached visitors, not just site owners. Organizations whose people visited during the week may inherit data-theft exposure even though the reported payloads left no persistent malware.
4 sources · 4h ago
CVEs in this update
8 CVEs
Across Chrome, safari, ipados, and related packages.
0 critical · 6 high · 2 medium · 0 low
7 in CISA KEV · 5 with EPSS above 1%
Highest severity: CVE-2025-14174 · 8.8 HIGH
Highest EPSS: CVE-2025-14174 · 55.3%
Timeline Nov 4 Reported by Help Net Security Oct 29 Reported by Sekoia.io Apr 3 CISA federal deadline for CVE-2025-43520 passedMar 27 CISA federal deadline for CVE-2026-3910 passedMar 20 CVE-2025-43520 added to CISA KEVMar 13 CVE-2026-3910 added to CISA KEVMar 5 CISA federal deadline for CVE-2026-20700 passedFeb 12 CVE-2026-20700 added to CISA KEVJan 5 CISA federal deadline for CVE-2025-43529 passedJan 2 CISA federal deadline for CVE-2025-14174 passedDec 15 CVE-2025-43529 added to CISA KEVDec 12 CVE-2025-14174 added to CISA KEVJun 24 CISA federal deadline for CVE-2025-27038 passedJun 3 CVE-2025-27038 added to CISA KEVSources Nov 4 Help Net Security
Russian hackers target iOS and Android users with n-day exploits - Help Net Security
Russia’s APT29 used compromised sites and a hijacked Ukrainian analytics tracker to hit unpatched mobile devices with n-day exploits.
original Nov 4 The Hacker News
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29-linked attackers use compromised sites and Plerdy analytics to deliver iOS and Android exploits that steal browser and device data.
original Nov 4 Infosecurity Magazine
APT29 Watering Holes Target Unpatched iPhones and Android Devices
APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users
original Part of the PlainSec briefing for 2026-11-04
Every edition of this story: APT29 used analytics code to reach hundreds of sites
More from today Threats & Adversaries · APT / Espionage
APT29 used analytics code to reach hundreds of sites Sekoia uncovered in mid-October 2026 a campaign it attributes with moderate-to-high confidence to APT29 : a compromised Ukrainian analytics service exposed visitors across hundreds of legitimate sites to exploit delivery for one week. The campaign also used directly compromised websites and attacker-controlled lookalike domains.
The analytics script ran in visitors’ browsers, profiled their device and browser, then sent them to a delivery server that selected a matching exploit—no click required. Sekoia says the payloads stole cookies or full device data from iOS devices, and Chrome data and Wi-Fi passwords from Android devices, without leaving a persistent implant.
For organizations whose sites loaded that supplier, the exposure reached visitors, not just site owners. Organizations whose people visited during the week may inherit data-theft exposure even though the reported payloads left no persistent malware.
4 sources · 4h ago
CVEs in this update
8 CVEs
Across Chrome, safari, ipados, and related packages.
0 critical · 6 high · 2 medium · 0 low
7 in CISA KEV · 5 with EPSS above 1%
Highest severity: CVE-2025-14174 · 8.8 HIGH
Highest EPSS: CVE-2025-14174 · 55.3%
Timeline Nov 4 Reported by Help Net Security Oct 29 Reported by Sekoia.io Apr 3 CISA federal deadline for CVE-2025-43520 passedMar 27 CISA federal deadline for CVE-2026-3910 passedMar 20 CVE-2025-43520 added to CISA KEVMar 13 CVE-2026-3910 added to CISA KEVMar 5 CISA federal deadline for CVE-2026-20700 passedFeb 12 CVE-2026-20700 added to CISA KEVJan 5 CISA federal deadline for CVE-2025-43529 passedJan 2 CISA federal deadline for CVE-2025-14174 passedDec 15 CVE-2025-43529 added to CISA KEVDec 12 CVE-2025-14174 added to CISA KEVJun 24 CISA federal deadline for CVE-2025-27038 passedJun 3 CVE-2025-27038 added to CISA KEVSources Nov 4 Help Net Security
Russian hackers target iOS and Android users with n-day exploits - Help Net Security
Russia’s APT29 used compromised sites and a hijacked Ukrainian analytics tracker to hit unpatched mobile devices with n-day exploits.
original Nov 4 The Hacker News
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29-linked attackers use compromised sites and Plerdy analytics to deliver iOS and Android exploits that steal browser and device data.
original Nov 4 Infosecurity Magazine
APT29 Watering Holes Target Unpatched iPhones and Android Devices
APT29 compromised Ukrainian analytics tracker Plerdy to serve n-day exploits to mobile users
original Part of the PlainSec briefing for 2026-11-04
Every edition of this story: APT29 used analytics code to reach hundreds of sites
More from today