Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware
Original title: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
CISA added CVE-2024-27834 to its KEV catalog after APT29 exploited it in a zero-click chain to deliver browser data-stealing malware to FCEB agencies.
The U.S. Cybersecurity and Infrastructure Security Agency added a medium-severity flaw (CVE-2024-27834, CVSS 5.5) in multiple Apple operating systems to its Known Exploited Vulnerabilities catalog. The flaw, a case of improper authentication allowing arbitrary read and write capability to bypass Pointer Authentication, was addressed by Apple in May 2024. Threat actors possibly linked to Russia, the APT29 group, exploited the patched vulnerability along with others in Safari and Google Chrome to deliver an information-stealing payload via compromised websites, fake sites, and a supply chain attack on Plerdy SEO Tracker.
Unconfirmed: No confirmed attacks stated beyond CISA KEV addition and Sekoia report
- CVE-2024-27834 added to CISA KEV catalog
- Exploited in zero-click chain with WebKit RCE flaw
- APT29 group attributed with moderate to high confidence
- Attack pathways include compromised sites, fake sites, supply chain
- FCEB agencies must patch by November 18, 2026
Impact: information theft via browser cookies and device data
| Product | Affected |
|---|---|
| Apple iOS | 16.7.8 and later affected |
| Apple macOS | Sonoma 14.5 and later affected |
| Apple Safari | 17.5 and later affected |
- 1.Apply patches by November 18, 2026
- CVEs
- CVE-2024-27834
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
From the original article
1 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.