Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

CISA has placed CVE-2024-27834, a medium-severity authentication flaw affecting iOS, iPadOS, macOS Sonoma, tvOS, watchOS and Safari, into its Known Exploited Vulnerabilities catalog after confirming real-world abuse. Apple fixed the issue back in May 2024, but attackers are now chaining it with a separate WebKit remote-code-execution bug to defeat Pointer Authentication protections and run malicious JavaScript that steals browser cookies and device data. Researchers at Sekoia tie the campaign with moderate-to-high confidence to the Russia-linked group APT29 (Cozy Bear/Midnight Blizzard), which reportedly reaches victims through hacked legitimate sites, lookalike fake pages, and a compromised Plerdy SEO Tracker supply chain. Federal agencies in the US have been told to apply the available patches by November 18, 2026, underscoring that even long-patched Apple bugs remain valuable to sophisticated attackers targeting unupdated devices.