CISA flags exploited Apple PAC bypass used in watering-hole campaign
November 5: The Record added that Plerdy was compromised from late August to early September, DarkSword hit iOS 18.5, and Sekoia could not say how many phones were infected.
CISA ordered federal agencies to patch Apple CVE-2024-27834 by November 18, 2026, after Sekoia tied it to APT29 zero-click watering holes.
CISA added Apple CVE-2024-27834 (CVSS 5.5), a Pointer Authentication bypass, to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must remediate it by November 18, 2026. Apple patched the flaw in May 2024; it does not grant code execution and only bypasses PAC after arbitrary memory access. According to Sekoia, APT29 used the already-patched bug, with moderate to high confidence, in zero-click chains via compromised sites, spoofed sites and a Plerdy supply-chain compromise to steal cookies, messages and device data from iPhones and Androids. SecurityWeek attributes related watering-hole attacks on diplomatic and government targets in the US, Ukraine, the Czech Republic and Bulgaria to Midnight Blizzard. The Record says the campaign would not work on fully updated devices, and Sekoia has not established how many phones were compromised.
- Apple fixed it in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS 14.5, tvOS 17.5 and watchOS 10.5.
- FCEB agencies must remediate the KEV-listed flaw by November 18, 2026.
- Sekoia says Plerdy’s tracking script was compromised from late August to early September.
- The Record: DarkSword on iOS 18.5 took messages, passwords, photos and location history.
- SecurityWeek says the chains also hit Android Chrome users and reused n-day bugs.
- Spoofed sites included America250 and Raffles London at The OWO, The Record reports.
Timeline
dated events in the reporting · oldest first- Nov 18, 2026FCEB agencies must remediate CVE-2024-27834 · Security Affairs
What each outlet adds
beyond the shared facts- Security AffairsLists Apple’s May 2024 fixed versions and says the bug needs prior memory access.
- SecurityWeekNames Midnight Blizzard and diplomatic targets in four countries, plus Android chains.
- The RecordPlerdy compromise window, spoofed site names, and no confirmed victim count.
- The Hacker NewsSays the chain included a WebKit remote-code-execution flaw.
- Threat actors
- APT29Midnight Blizzard
- Malware
- DarkSword
- Victims
- Plerdy
Coverage
oldest first · one row per article · UTC- · 6d ago
The Hacker NewsFirst report
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware
CISA added CVE-2024-27834 to its KEV catalog after APT29 exploited it in a zero-click chain to deliver browser data-stealing malware to FCEB agencies.
- · 6d ago
Security Affairs
CISA adds exploited Apple PAC bypass CVE-2024-27834 to KEV
Federal agencies must fix the flaw by November 18, 2026; Sekoia ties its use to APT29 with moderate to high confidence.
- · 6d ago
SecurityWeek
Midnight Blizzard uses exploit chains in watering holes
Russia-linked APT29 deploys zero-click exploits via watering holes against iOS Android users in Europe and US targeting high-profile sites.
- · 6d ago
The Record
APT29 ran zero-click smartphone espionage campaign against Ukraine, US and Europe
Sekoia says the SVR-linked group watered legitimate and spoofed websites and compromised Plerdy analytics to steal messages, passwords and photos from iPhones and Androids.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-27834 | Improper Authentication in Apple Products Bypassing Pointer Authentication | 5.5 | 2% | KEV | KEV |
| CVE-2025-27038 | Use-After-Free in Qualcomm Adreno GPU Drivers Affects Multiple Chipsets | 7.5 | 1% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |