Security researchers have reported a large-scale watering hole campaign attributed to the Russia-linked group APT29, involving compromised websites, fake domains and a supply-chain attack on a web analytics service called Plerdy SEO Tracker. According to the report, malicious JavaScript was injected to profile visitors’ devices and help deliver exploits to iOS and Android users.

While the reported operation appears to be focused on mobile exploitation rather than broad business disruption, it is highly relevant for European companies that rely on third-party scripts for analytics, marketing and website functionality. The incident is a reminder that code loaded from external services can become a security risk for both site operators and visitors.

What happened

According to researchers cited in the report, attackers linked to APT29 compromised websites and used fake domains as part of a watering hole campaign. In addition, the operation reportedly involved a supply-chain compromise affecting Plerdy SEO Tracker, a web analytics service used on websites.

The injected JavaScript was said to collect browser and device attributes from visitors. That information can help attackers decide whether a user is a suitable target and which exploit chain to serve. The reported targets included both iOS and Android devices.

At the time of reporting, the findings reflect researchers’ attribution and analysis. Businesses should treat the technical details as reported by the researchers unless independently confirmed by affected vendors or authorities.

Why it matters for European businesses

Many European SMEs and e-commerce companies use external scripts for analytics, chat tools, tag management, A/B testing, consent tools and marketing automation. These scripts often run with broad access inside the browser session of website visitors. If one of those third-party services is compromised, a legitimate business website can unintentionally become part of a malicious delivery chain.

This creates several risks:

• Customer trust risk: visitors may be exposed to malicious code while browsing an otherwise legitimate company website.
• Security risk: external JavaScript can be used to fingerprint devices, redirect users or load additional payloads.
• Operational risk: incident response may require emergency script removal, website reviews and vendor coordination.
• Compliance risk: if a compromise affects personal data, businesses may need to assess GDPR-related obligations and notification requirements based on the facts of the incident.

The case is also relevant beyond one specific vendor. It shows how marketing and analytics tooling can expand the attack surface of a website, especially when scripts are added over time without a clear inventory or security review.

Who may be affected

The immediate exposure would be greatest for organisations using the affected analytics service or any compromised website components described by the researchers. More broadly, the story matters for:

• SMEs running websites with multiple third-party marketing or analytics scripts
• e-commerce businesses that depend on external frontend tools
• marketing teams deploying tags and tracking code through tag managers
• IT and security teams responsible for website security and vendor risk
• digital agencies managing client websites and martech stacks

Businesses serving customers on mobile devices should pay particular attention, as the reported campaign focused on iOS and Android users.

What companies should consider

• Review third-party scripts: create an inventory of analytics, advertising, chat and optimisation scripts running on your websites.
• Check vendor exposure: verify whether any affected services, domains or script sources are present in your environment.
• Reduce unnecessary dependencies: remove scripts that are no longer needed or that provide limited business value.
• Strengthen script governance: ensure marketing tags and external code cannot be added to production sites without oversight.
• Monitor for unusual behaviour: look for unexpected redirects, new outbound connections, changes in script content or spikes in mobile user complaints.
• Prepare response steps: define how to disable third-party scripts quickly if a vendor compromise is suspected.
• Assess data protection implications: if visitor data may have been exposed or collected unlawfully, involve legal and privacy teams to evaluate notification duties.

For companies that rely heavily on martech and analytics integrations, this incident underlines a practical security priority: website performance and marketing insight should not come at the cost of uncontrolled third-party code execution.