Search — “AndroSnitch”

Sekoia reports that APT29 is presumed behind a watering hole campaign using compromised sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script (main.js, August 27 to September 3, 2026) to deliver a JavaScript loader that profiles visitors and serves iOS (DarkSword-based) or Android (AndroSnitch) exploit chains. The sources describe exfiltration to ad.starx-net[.]com:8881/telemetry/v12 but do not confirm how many victims were compromised. Hunters should look for outbound connections to that endpoint, requests to a.plerdy[.]com/public/js/click/main.js, and visits to the listed lookalike domains.