Search — “CVE-2024-27834”

Sekoia reports that APT29 is presumed behind a watering hole campaign using compromised sites, lookalike domains, and a supply chain compromise of the Plerdy SEO Tracker script (main.js, August 27 to September 3, 2026) to deliver a JavaScript loader that profiles visitors and serves iOS (DarkSword-based) or Android (AndroSnitch) exploit chains. The sources describe exfiltration to ad.starx-net[.]com:8881/telemetry/v12 but do not confirm how many victims were compromised. Hunters should look for outbound connections to that endpoint, requests to a.plerdy[.]com/public/js/click/main.js, and visits to the listed lookalike domains.

CISA added CVE-2024-27834, a medium-severity Apple improper authentication (Pointer Authentication bypass) flaw, to its KEV catalog after reports of active exploitation. Sekoia reported that possibly Russia-linked actors, attributed by the source to APT29 with moderate to high confidence, used the flaw alongside previously patched Safari and Chrome vulnerabilities to serve JavaScript that profiles visitors and deploys browser-cookie-stealing malware. Access came via compromised legitimate websites, fake lookalike sites, and a supply-chain attack on Plerdy SEO Tracker. The source does not print specific hunting artifacts, so defenders should focus on patch status for listed Apple builds and on web-based delivery and browser cookie theft behavior.

Sekoia attributes with moderate-to-high confidence a watering-hole campaign to APT29 that used compromised legitimate sites and lookalike domains, plus a tampered Plerdy SEO tracker loaded by thousands of Ukrainian-heavy sites between August 27 and September 3. Injected JavaScript profiled visitor devices and browser versions, after which the C2 server pushed platform-specific n-day exploit chains. The sources report no confirmed compromises and say Apple and Google have patched the targeted flaws; hunters should look for visits to the named compromised or lookalike domains and the injected Plerdy tracker script.