Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

CVE-2024-27834 is an improper-authentication vulnerability in Apple software. It matters because it can undermine Pointer Authentication, a protection designed to make hijacked code execution harder. CISA rated the flaw medium severity, with a CVSS score of 5.5, but active exploitation makes its practical risk more serious.

The key condition is unusual but powerful: the attacker needs arbitrary read and write capability. With that access, the attacker could bypass Pointer Authentication. The article reports that the flaw was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest in March 2024. Apple later addressed it with improved checks.

Apple released fixes in May 2024 across several operating systems and Safari. CISA nevertheless added the flaw to its Known Exploited Vulnerabilities catalog after reports of real-world exploitation. That listing signals that organizations should treat the issue as actively abused, not merely theoretical, and apply the relevant updates promptly.

Before Apple issued fixes, the vulnerability affected six named Apple operating systems or products. They were iOS, iPadOS, macOS, tvOS, watchOS, and Safari. This broad spread mattered because the same security issue reached phones, tablets, computers, televisions, watches, and Apple’s browser.

Apple addressed the problem in May 2024. The listed fixes were iOS 16.7.8 and iPadOS 16.7.8; iOS 17.5 and iPadOS 17.5; macOS Sonoma 14.5; tvOS 17.5; watchOS 10.5; and Safari 17.5. These are version-specific updates, not one universal patch.

The range shows why organizations must match updates to each Apple device or software deployment. The later report of active exploitation also changes the urgency. Even though patches existed, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, highlighting that unpatched systems remained exposed.

The campaign used familiar web pathways rather than relying on one delivery channel. Attackers compromised legitimate websites, created fake sites that imitated popular destinations, and carried out a supply-chain attack aimed at Plerdy SEO Tracker. These routes helped place malicious JavaScript in front of potential victims.

The JavaScript did not simply attack every visitor in the same way. The article says it first profiled the visitor’s device. After that check, it triggered the vulnerability and ultimately delivered an information-stealing payload. This approach could help attackers select suitable targets and avoid wasting the exploit on incompatible systems.

Sekoia linked the activity to threat actors possibly connected to Russia and reported exploitation of patched Safari and Google Chrome vulnerabilities. The campaign shows why trusted websites and embedded services can become delivery points. Keeping browsers, operating systems, and third-party web tools updated can reduce exposure, although the article does not describe every defensive measure.

After the exploit succeeded, the campaign delivered malware capable of harvesting browser and device data. The reported zero-click exploit chain included a JavaScript payload designed for browser cookie theft. Cookies can represent valuable browser-held information, so their theft can make a victim’s online activity more vulnerable.

The attack first profiled the visitor’s device, then triggered the vulnerability and delivered the information-stealing payload. Sekoia reported that threat actors exploited previously patched vulnerabilities in Safari and Google Chrome. The article specifically connects the payload to browser cookies, while also describing broader collection of browser and device data.

The practical consequence is that installing a malicious payload can turn a web visit into an information-gathering event. Patching browsers and operating systems is therefore important even after a vulnerability has been fixed upstream. The article’s warning is especially relevant because the campaign involved active exploitation and multiple web-based entry routes.

CISA’s Known Exploited Vulnerabilities catalog identifies security flaws with evidence of exploitation. Adding CVE-2024-27834 therefore raises the issue’s priority for federal civilian executive branch agencies. The flaw’s medium CVSS score alone does not capture the urgency created by real attacks.

The article says the addition followed reports of active exploitation. Sekoia described a campaign in which threat actors used malicious JavaScript, exploited previously patched browser vulnerabilities, and delivered information-stealing malware. The Apple flaw had also been demonstrated as a zero-day at Pwn2Own Vancouver in March 2024.

Because attackers may target systems that remain unpatched, agencies must locate affected Apple software and apply the relevant fixes. The article recommends that FCEB agencies complete patching by November 18, 2026. The deadline turns a general security recommendation into a concrete government remediation task, while the KEV entry signals continuing operational risk.

APT29 is the name used for a state-sponsored hacking group also known as Cozy Bear and Midnight Blizzard. The article identifies it as affiliated with Russia’s Foreign Intelligence Service. That makes the campaign more than an ordinary criminal operation, because the reported actor is connected to a national intelligence service.

Sekoia attributed the activity to APT29 with moderate to high confidence. The report described threat actors possibly linked to Russia exploiting patched vulnerabilities in Safari and Google Chrome. Their campaign used compromised legitimate sites, fake popular websites, and a supply-chain attack targeting Plerdy SEO Tracker.

The attribution reflects investigators’ assessment, not a claim that every detail is publicly proven. Still, the article presents the Russia connection and APT29 identification as the leading explanation. The group’s reported use of multiple access paths and browser-focused malware helps explain why agencies should treat the activity as a serious targeted campaign.

Pointer Authentication is a hardware-supported security mechanism used by modern processors to protect pointers. A pointer stores an address used by software, and Pointer Authentication associates it with a cryptographic authentication code. Before using the pointer, the processor can check whether the code still matches.

Normally, this makes tampering harder. If an attacker changes a pointer to redirect execution, the authentication check can detect that the pointer is invalid. The protection is especially useful against attacks that try to reuse or hijack existing code. In the article, CVE-2024-27834 matters because an attacker with arbitrary read and write capability could bypass this safeguard.

A successful bypass does not automatically describe every later attack step, but it removes an important barrier to code hijacking. Apple addressed the flaw with improved checks in multiple operating-system and Safari releases. The reported exploitation shows why hardware protections still depend on correct software implementation and timely patching.