Plerdy SEO Tracker Script Hijacked: What to Check

Security firm Sekoia reported on November 4, 2026 that the script of Plerdy, a web analytics and SEO service, was tampered with between August 27 and September 3. Sites that loaded it served their visitors attacks aimed at unpatched phones. If Plerdy is on your site, this concerns you.

What we know

  • The file: according to Sekoia, attackers injected code into the legitimate `main.js` file of Plerdy's tracker, served from a.plerdy.com. Sekoia says the script is loaded by «thousands of websites», the large majority Ukrainian, and also calls it the «Plerdy SEO Tracker».
  • The dates: Sekoia places the tampering between August 27 and September 3, 2026, one week. Its team uncovered the campaign in mid-October and published the report on November 4.
  • What it did: the code pulled a fingerprinting script from another domain and, depending on the phone, served one of three exploit chains: iPhones on iOS 16.7 (cookie theft), iPhones on iOS 18.5 (device data theft) and Android devices running Chrome 139 to 145, except 143 (theft of Chrome data and Wi-Fi passwords).
  • Who, according to Sekoia: it attributes the campaign to APT29, the group several governments link to Russian intelligence, «or at least one of its subgroups», with moderate to high confidence. That is Sekoia's assessment, not a legal finding.
  • Beyond Plerdy: the same report describes other sites compromised directly (on one, attackers modified a JavaScript library the site already used) and fake sites that mirrored real ones on the fly.
  • The flaws are already patched: Sekoia says every chain relies on fixed vulnerabilities and that a phone with an up-to-date operating system is safe.

What changes and what doesn't

  • The targets were visitors, not servers. The code ran in the browser of whoever opened the page. The report does not describe data being taken from the sites that loaded the script.
  • What the report leaves open: how the file was altered, whether Plerdy was notified, and whether it fixed the cause (only that the tampering lasted a week). As of November 4 there was no public statement from Plerdy about it.
  • Second case in a week. In late October, DebugBear's monitoring script served malicious code after its DNS was hijacked. Any third-party script runs on your site with the same power as your own code.

How to check if it affects you

  1. Search your site for "plerdy": in the page source, in the browser's Network tab and in your tag manager (Google Tag Manager or similar). Check analytics plugins and modules too.
  2. If it was loading between August 27 and September 3, visitors on unpatched phones may have been served the attack. If your site has logins, end active sessions and confirm session cookies carry the HttpOnly flag, which keeps JavaScript from reading them.
  3. Decide whether to keep it and ask Plerdy in writing what happened and what changed. Until you hear back, at least remove it from login, checkout and account pages.
  4. List your external scripts and drop those from services you no longer use. In October, Report URI documented more than 660 domains of abandoned services that someone re-registered to serve code to sites still loading them.
  5. Limit where code can come from: a Content Security Policy that only allows the domains on your list, plus alerts when a new script appears. It won't stop a tampered legitimate file, but it reduces the damage.
  6. Update your own phone and ask your team to do the same: that is the defense the report considers enough.

Related: DebugBear Script Compromised: What Site Owners Should Do

Sources

Updates: if Plerdy issues a statement or Sekoia shares more on affected sites, it will be added here with a link.