Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with
On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) included a medium-level security flaw in its Known Exploited Vulnerabilities (KEV) list, following reports of the flaw being actively exploited. The vulnerability, identified as CVE-2024-27834 (CVSS score: 5.5), stems from insufficient authentication, potentially enabling an attacker to bypass Pointer Authentication and gain arbitrary read and write privileges.
Apple patched this flaw in May 2024 with updates to iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The flaw was showcased as a zero-day exploit during the Pwn2Own Vancouver hacking competition in March 2024.
Sekoia, a security analysis firm, reported that hackers, possibly affiliated with Russia, might have exploited similar vulnerabilities in Safari and Google Chrome to deploy malware capable of harvesting browsing and device data. This has been attributed to APT29, a state-sponsored hacking group linked to Russia's Foreign Intelligence Service, with moderate to high confidence.
The attack employs three entry points – compromised legitimate websites, fraudulent sites replicating popular sites, and a supply chain attack targeting Plerdy SEO Tracker – to inject malicious JavaScript code. This code triggers the vulnerability and subsequently delivers the information-stealing payload, which profiles the visitor's device. In response to the active exploitation, FCEB agencies are urged to apply the necessary patches by November 18, 2026.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
