Vendor incident, severity critical
Plerdy SEO Tracker analytics script compromised in APT29-linked campaign delivering iOS and Android exploits
Published
The Russia-linked threat actor APT29 is said to be behind a watering hole campaign that used compromised websites, fake domains and a supply chain attack on the Ukrainian web analytics service Plerdy SEO Tracker. The injected JavaScript collects browser and device attributes and targets iOS and Android users. Websites that load the Plerdy script may have served the malicious code to their visitors.
What's affected
- plerdyevery version
What to do
- Check whether any of your websites load the Plerdy SEO Tracker script
- Remove or disable the Plerdy script until the vendor confirms it is clean
- Inspect your site pages for injected or unexpected JavaScript
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident plerdy-seo-tracker-supply-chain-2026-11References
Notice plerdy-seo-tracker-supply-chain-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.