APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits

APT29 has been linked to a sophisticated watering hole campaign exploiting compromised websites, fake domains, and a Ukrainian analytics supply chain called Plerdy SEO Tracker. The attackers leverage compromised infrastructure and expired domains associated with legacy analytics tags to deliver JavaScript loaders profiling target devices. Depending on the visitor's operating system, the chain delivers mobile exploit frameworks like DarkSword for iOS or custom payloads like AndroSnitch for Android to steal cookies, Wi-Fi credentials, and device data.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai discovers expired domains, dangling CNAME records, and abandoned third-party tracking tags that attackers can register to hijack external perimeter assets.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain