APT29 Hijacks Plerdy Script to Hit Unpatched Phones

What to do

1. Pull an OS-version report from your MDM and update or retire any iPhone or iPad not on a current iOS/iPadOS release.
2. Make sure Android devices run a current Chrome build (anything 139 to 145 is in scope) and current Android security patches.
3. If any of your sites loaded the Plerdy tracker, check whether it was active between August 27 and September 3, 2026, and tell your security team which audiences visited.
4. Block and hunt for the published infrastructure: static.flux-telemetry.com, edge-ord.clouds-stacks.com, ad.starx-net.com and the lookalikes america250.holiday and theowo.club.
5. Audit third-party JavaScript on your sites; pin it with Subresource Integrity or self-host it where the vendor allows.
6. Federal agencies: remediate CVE-2024-27834 by the KEV due date of November 18, 2026.

How to check if you are affected or compromised

• Search DNS, proxy and firewall logs for static.flux-telemetry.com, edge-ord.clouds-stacks.com and ad.starx-net.com (port 8881, path /telemetry/v12), and the IPs 109.104.106.107, 95.133.231.28 and 195.58.140.105.
• Search web and CDN logs or archived page captures for requests to a.plerdy.com/public/js/click/main.js between August 27 and September 3, 2026.
• Treat browser session cookies on any outdated phone that visited affected sites as stolen: revoke sessions and re-authenticate.
• Ask Sekoia or your national CERT for the withheld IOCs and YARA rules (shared under TLP:AMBER).

What happened#

On November 4, 2026, CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalog, with a federal due date of November 18. The bug is two and a half years old. It is a WebKit flaw that lets an attacker who already has arbitrary read and write bypass Pointer Authentication (PAC), Apple's hardware defense against code-reuse attacks. Manfred Paul demonstrated it at Pwn2Own in 2024, and Apple fixed it on May 13, 2024, in iOS and iPadOS 16.7.8, iOS 17.5, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5. CISA's ADP entry on the CVE record scores it 5.5. The score is modest because, on its own, the bug is only one link in a chain.

The context for the listing came out the same day. In "Poisoned Source", Sekoia describes a watering-hole campaign it found in mid-October. Sekoia attributes it with moderate to high confidence to APT29, the group linked to Russia's SVR. The campaign served n-day exploit chains to phones through three routes: injected JavaScript on legitimate sites (including a U.S. chemical-industry trade association and a Bulgarian military-related site), lookalike domains such as america250[.]holiday, and a supply-chain compromise of the Plerdy SEO Tracker, a Ukrainian web-analytics service. Between August 27 and September 3, 2026, code injected into a.plerdy[.]com/public/js/click/main.js loaded a fingerprinting script. That script profiled each visitor's device and passed it to the matching exploit chain.

Sekoia lists three chains:

• Class A, iOS 16.7: CVE-2025-43529 plus CVE-2024-27834. It ran JavaScript that steals browser cookies. Sekoia says the chain may work on iOS 16.0 through 17.4.
• Class B, iOS 18.5: the DarkSword chain (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520). It collected the whole device: messages, mail databases, WhatsApp and Telegram data, iCloud Keychain, Wi-Fi passwords, photos and more.
• Class C, Chrome 139 to 145 on Android (excluding 143): CVE-2026-3910 and CVE-2025-27038. It dropped a stealer Sekoia calls AndroSnitch, which takes Chrome data and Wi-Fi passwords without staying on the device.

All three sent data to ad.starx-net[.]com:8881/telemetry/v12.

Who is affected#

Only devices that are behind on updates. Sekoia states that all three chains use already-patched vulnerabilities and that "a user running an up-to-date operating system is safe from these attacks." The people at risk are the long tail: iPhones that can't run newer iOS versions, phones whose owners postpone updates, and Android devices with stale Chrome. Visitor targeting is unclear. Sekoia can't tell whether the attackers chose specific sites' audiences or collected broadly and picked targets later. Many of the compromised sites draw visitors interested in defense and the war in Ukraine.

For website operators, the Plerdy compromise is the developer angle. If your pages loaded Plerdy's click script during that week, your site delivered the fingerprinting script to your visitors without your knowledge.

Do you really need to act?#

Check exposure; don't panic. The headline mentions a nation-state, but the fix is ordinary update hygiene that most fleets already do. Act if your MDM shows devices below current iOS or Chrome releases, especially those used by staff in government, defense, policy or Ukraine-related work. Act if you embedded Plerdy. Everyone else should treat this as a reminder that "patched in 2024" does not mean "patched on every device."

What to do now#

1. Export OS versions from your MDM. Update or retire any iPhone or iPad that is not on a current release.
2. Bring Android Chrome up to date and enforce minimum versions through managed Play or your MDM.
3. If you use Plerdy, confirm with the vendor and your own logs whether the script loaded on your pages between August 27 and September 3, and brief your security team on who your visitors are.
4. Block and hunt for static.flux-telemetry[.]com, edge-ord.clouds-stacks[.]com, ad.starx-net[.]com, america250[.]holiday and theowo[.]club.
5. Review third-party scripts. Where a vendor publishes versioned files, pin them with integrity= (Subresource Integrity) or self-host them.

How to tell if you were hit#

Search DNS and proxy logs for the domains above and the IPs 109.104.106[.]107, 95.133.231[.]28 and 195.58.140[.]105, and look for any traffic to port 8881 with the path /telemetry/v12. The cookie-stealing chains leave little on the device, so if an outdated phone matches, revoke that user's web sessions and tokens, and reset Wi-Fi credentials for Class B and C matches. Sekoia withholds additional IOCs and YARA rules but shares them with national CERTs under TLP:AMBER.

Timeline#

• May 13, 2024 — Apple fixes CVE-2024-27834 in iOS 16.7.8/17.5, macOS 14.5 and Safari 17.5.
• Aug 27, 2026 — Plerdy tracker script begins serving injected code (through September 3).
• Mid-October 2026 — Sekoia discovers the campaign.
• Nov 4, 2026 — Sekoia publishes "Poisoned Source"; CISA adds CVE-2024-27834 to KEV (due November 18).

Vulnerability records

• CVE-2024-27834 · KEV 2026-11-04 · The issue was addressed with improved checks.
• CVE-2025-43529 · KEV 2025-12-15 · A use-after-free issue was addressed with improved memory management.
• CVE-2026-20700 · KEV 2026-02-12 · A memory corruption issue was addressed with improved state management.
• CVE-2025-14174 · KEV 2025-12-12 · Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…
• CVE-2025-43510 · KEV 2026-03-20 · A memory corruption issue was addressed with improved lock state checking.
• CVE-2025-43520 · KEV 2026-03-20 · A memory corruption issue was addressed with improved memory handling.
• CVE-2026-3910 · KEV 2026-03-13 · Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
• CVE-2025-27038 · KEV 2025-06-03 · Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Sekoia — Poisoned Source: APT29 watering holes target mobile devices with n-day exploits sekoia.com
2. CISA — Known Exploited Vulnerabilities Catalog cisa.gov
3. Apple — About the security content of iOS 16.7.8 and iPadOS 16.7.8 support.apple.com
4. Apple — About the security content of macOS Sonoma 14.5 support.apple.com
5. Apple — About the security content of Safari 17.5 support.apple.com
6. CVE.org — CVE-2024-27834 cve.org

Coverage and analysis

1. The Hacker News — APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits thehackernews.com
2. The Hacker News — Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says thehackernews.com