decrypted · 6 november 2026 · vulnerabilities and patching · supply chain · uk policy and law

A hijacked analytics script, and the phones it quietly emptied

A Russian-linked spying campaign has come into focus since this morning's post. Security firm Sekoia published its findings on 4 November: phones were attacked through a third-party analytics script that websites had loaded in good faith. Sekoia attributes the campaign, with moderate to high confidence, to APT29, also called Midnight Blizzard and widely linked to Russian intelligence. That is an attribution, not a court finding.

A tracker that changed hands

Between 27 August and 3 September, a file on the servers of Plerdy, a search optimisation tracking service, was modified. Any site loading the tracker pulled in a fingerprinting script. Sekoia says thousands of sites load the tracker, mostly Ukrainian, while SecurityWeek says hundreds were exposed. Lookalike domains and injected code on legitimate sites ran alongside.

Think of an embedded script as a front-door key handed to a contractor, who then trusts their own subcontractors. You never vetted the subcontractor, yet visitors walk through the door they hold.

Quiet, selective, patched

The script profiles each visitor and serves an attack only if the device looks like a real phone. Sekoia describes three chains for iPhones and Android, all built on flaws already patched, so no zero-days, which are flaws used before a fix exists. One iPhone chain steals browser cookies, including those of apps outside Safari. A fuller one harvests messages, the Keychain and Wi-Fi passwords. The Android payload, AndroSnitch, takes Chrome cookies, logins and history.

Nothing persists, and BleepingComputer notes that a reboot ends the activity. Sekoia calls it consistent with intelligence gathering: stolen session cookies could let an attacker reuse a logged-in session, webmail included.

What the defender sees

Almost nothing. Your website loads normally. The script hides inside roughly 2.3 megabytes of dead code, about 98% of the file, which Sekoia suggests may make it look legitimate or hinder analysis. The damage happens on the visitor's phone, so your server logs show an ordinary visit. Nothing on your side raises an alert unless you already watch which scripts your pages load, so the first you hear of it may be someone else's incident report.

The Secure by Design lesson

The failed design decision was giving an outside script the full authority of your page. Three controls cost little:

List every third-party script on your public sites, and remove any nobody can justify.
Set a Content Security Policy, a browser rule limiting where scripts load from and send data to.
Pin rarely changing files with Subresource Integrity, a checksum the browser verifies. It breaks on self-updating trackers, which is the honest price.

Because every chain used patched bugs, the boring control matters too: force phone updates through mobile device management.

The UK angle is thin. Sekoia names no UK victims; one lookalike domain imitated a London hotel, which Sekoia says may have aimed at diplomatic guests. That is its reasoning, not a confirmed target.

Also this week

WordPress, where the updater was the hole. Release 7.1.4, out on 28 October, fixes a flaw in the upgrade process itself. During a full core upgrade, files are staged at predictable, web-accessible paths, and an attacker who requests one in that narrow window can run code on the server without logging in. That is remote code execution, or RCE. CISA, America's national cyber security agency, added it on 3 November to its KEV list of flaws known to be exploited, as CVE-2026-119977, the public reference number the flaw was given. Wordfence scores it 8.1 on CVSS, the zero-to-ten severity score, while WordPress's own release post gives no CVE or severity. Trade press reports Wordfence saw attempts but no confirmed compromises as of 31 October, and attempts are not breaches. Staging code in a guessable public folder is a design choice, not an accident. Update, then check web server logs for requests to PHP files under the upgrade directory.

The NCSC, the National Cyber Security Centre, publishes its annual review. The centre, part of GCHQ, launched its State of the Cyber Nation report on 3 November. It judges it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. In remarks released with it, chief executive Richard Horne said any rise would come "not because AI has invented new ways to attack us" but because long-tolerated weaknesses can now be found and exploited at scale. He added: "For decades, we have collectively got away with doing tech on the cheap." His asks were to invest adequately, avoid unnecessary internet connection and treat Cyber Essentials as a starting point. Government announced £60 million for the first phase of a Cyber Shield and £70 million for a new vulnerability centre. Opinion, not advice: that is the Secure by Design argument, made by the regulator.

Sources

If this raised questions about your own exposure, get in touch.