- Published on
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
- Authors
- Name
- DeepHorus
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834, a medium-severity Apple flaw, to its Known Exploited Vulnerabilities catalog on Wednesday. The move follows active exploitation by a Russian state-sponsored group. The vulnerability affects multiple Apple operating systems.
The flaw is an improper authentication issue (CVSS 5.5) enabling attackers to bypass Pointer Authentication. Apple patched it in May 2024 across iOS, iPadOS, macOS, tvOS, watchOS, and Safari. It was first shown as a zero-day at Pwn2Own Vancouver in March 2024.
Sekoia reported that APT29 (Cozy Bear/Midnight Blizzard), linked to Russia's Foreign Intelligence Service, exploited the flaw with "moderate to high confidence." The attacks used three initial access pathways: compromised legitimate websites, fake sites, and a supply chain attack on Plerdy SEO Tracker.
These pathways delivered malicious JavaScript that triggered the vulnerability and deployed info-stealing malware after profiling the device. The zero-click exploit chain combined CVE-2025-43529, a WebKit RCE flaw, with CVE-2024-27834 to execute JavaScript for cookie theft.
The KEV addition requires Federal Civilian Executive Branch agencies to patch by November 18, 2026. Exploitation of a previously patched flaw highlights persistent risk from sophisticated actors. Timely patching remains a critical defense for all organizations.
Experts note APT29's supply chain attack on an SEO tracker shows evolving tactics. The zero-click targeting of Apple users underscores the need for vigilance. Organizations should monitor for indicators of compromise.
With the 2026 deadline, federal agencies have a clear timeline. All Apple users are urged to update to patched versions. APT29's continued activity suggests similar attempts may persist.
