A third-party script compromise at Ukrainian analytics vendor Plerdy, plus JavaScript planted on hacked sites from the US to Bulgaria, fed phone visitors into a campaign Sekoia ties to Russia's APT29. If your pages load outside code, your site can serve an attack without a single visible change.
