Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
CISA has added a previously patched Apple vulnerability to its Known Exploited Vulnerabilities catalog, after a report that hackers linked to Russia are actively exploiting it to deliver information-stealing malware.
CISA has added a previously patched Apple vulnerability to its Known Exploited Vulnerabilities catalog, after a report that hackers linked to Russia are actively exploiting it to deliver information-stealing malware.
The flaw, CVE-2024-27834, is a Pointer Authentication bypass affecting iOS, iPadOS, macOS, tvOS, watchOS and Safari. It was first demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024, and Apple fixed it two months later with improved checks in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5.
Security firm Sekoia reported that threat actors it assesses are possibly linked to Russia have been exploiting this and other previously patched Safari and Chrome vulnerabilities to deliver malware that harvests browser and device data.
The campaign has been attributed to APT29 (also tracked as Cozy Bear and Midnight Blizzard), a state-sponsored group affiliated with Russia's Foreign Intelligence Service. The attackers use three separate routes to reach victims: compromised legitimate websites, fake sites impersonating popular ones, and a supply-chain compromise of the Plerdy SEO Tracker -- all serving malicious JavaScript that triggers the vulnerability, profiles the visitor's device, and deploys the information-stealing payload.
CISA's Known Exploited Vulnerabilities listing requires U.S. federal civilian agencies to apply the fix by November 18, 2026.
What happened
CISA has added CVE-2024-27834, a previously patched Apple vulnerability, to its Known Exploited Vulnerabilities catalog following reports of active exploitation.
Security firm Sekoia reported that threat actors it assesses are possibly linked to Russia are exploiting this flaw alongside other previously patched Safari and Chrome vulnerabilities to deliver information-stealing malware.
What changed
Although Apple fixed CVE-2024-27834 in May 2024, CISA's new KEV listing confirms it is now being actively exploited in the wild, more than two years after the patch shipped -- a reminder that an old, already-patched vulnerability can still become today's active threat if a meaningful share of devices never updated.
Who is affected
Devices still running an unpatched version are exposed -- specifically iOS and iPadOS versions before 16.7.8/17.5, macOS Sonoma before 14.5, tvOS before 17.5, watchOS before 10.5, and Safari before 17.5.
U.S. federal civilian agencies are required by CISA's KEV listing to apply the fix by November 18, 2026; the same deadline is a reasonable benchmark for any organization running affected Apple products.
Why it matters
The attack chain described by Sekoia reaches victims through three separate routes -- compromised legitimate websites, fake sites impersonating popular ones, and a supply-chain compromise of the Plerdy SEO Tracker -- so a victim doesn't need to do anything unusual to be exposed, just visit a page that happens to be compromised or spoofed.
The vulnerability is a Pointer Authentication bypass that gives an attacker with arbitrary read/write capability the ability to defeat one of Apple's core memory-safety protections, which is what turns a browser bug into full device compromise.
Technical details
CVE-2024-27834 (CVSS 5.5) is a case of improper authentication that lets an attacker with arbitrary read and write capability bypass Pointer Authentication. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.
Apple fixed it in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.
Response
CISA's KEV catalog addition sets a November 18, 2026 remediation deadline for U.S. federal civilian agencies.
What security teams should do
Confirm every Apple device in your environment is on iOS/iPadOS 17.5+, macOS Sonoma 14.5+, tvOS 17.5+, watchOS 10.5+ and Safari 17.5+ -- being on an older build means this exploit still works even though the patch has existed since May 2024.
Treat the Plerdy SEO Tracker supply-chain compromise as a live indicator: if your site or any site you rely on uses it, check for the malicious JavaScript Sekoia described.
Attribution to APT29/Cozy Bear/Midnight Blizzard means this activity fits a broader espionage-motivated pattern, not opportunistic cybercrime -- factor that into how you prioritize the patch.
What remains unknown
Sekoia's attribution of this specific exploitation to actors possibly linked to Russia is described as an assessment, not a confirmed fact; CISA's own KEV listing does not itself name an attacker.
Attribution
The Hacker News: CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after Sekoia reported active exploitation tied to a Russia-linked campaign delivering information-stealing malware.
What to watch next
Watch for further detail from Sekoia on the Plerdy SEO Tracker compromise and the full scope of affected sites.
Watch for CISA or Apple to confirm how widespread exploitation has been since the May 2024 patch shipped.