Hackers exploit patched Apple vulnerability to spread information-stealing malware, CISA says
The US Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw affecting multiple Apple operating systems to its catalog of known exploited vulnerabilities (KEVs), following reports of active exploitation.
The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capabilities to bypass pointer authentication.
Apple fixed this issue in May 2024 with improved controls in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day during Vancouver’s Pwn2Own hacking competition held in March of that year.
The addition of CVE-2024-27834 to the KEV catalog follows a report from Sekoia that threat actors potentially linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to distribute malware capable of harvesting browser and device data.
The activity was attributed to APT29 (aka Cozy Bear and Midnight Blizzard), a state-sponsored hacking group affiliated with Russian foreign intelligence services, with a “moderate to high confidence level.”
The attacks involve three initial entry paths – compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack targeting Plerdy SEO Tracker – to serve malicious JavaScript that triggers the vulnerability and ultimately deploy the information-stealing payload after profiling the visitor’s device.
The zero-click exploit chain combines CVE-2025-43529, a remote code execution flaw in WebKit, and CVE-2025-43529, the pointer authentication code (PAC) bypass, to execute a JavaScript payload designed to steal browser cookies.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to implement necessary fixes by November 18, 2026.
Gn tech
