Russia-Linked Hackers Were Exploiting a Patched Apple Flaw. CISA Has Noticed.

CISA has quietly added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog, confirming what security researchers have been warning about: someone has been actively weaponising a patched Apple vulnerability to steal browser data from compromised devices.

The flaw itself, rated medium severity with a CVSS score of 5.5, involves improper authentication that lets an attacker bypass Pointer Authentication — a hardware-level memory protection mechanism Apple uses across its platforms. Apple patched it back in May 2024 across iOS, iPadOS, macOS Sonoma, tvOS, watchOS, and Safari. The bug had already been shown off as a zero-day at Pwn2Own Vancouver in March of that year, so the security community knew it was exploitable. That knowledge, it turns out, was shared more widely than Apple would have liked.

The catalyst for CISA's catalog addition appears to be a report from threat intelligence firm Sekoia, which found evidence of active exploitation tied with moderate-to-high confidence to APT29 — the Russian Foreign Intelligence Service-affiliated group also known as Cozy Bear or Midnight Blizzard. These are the same people behind the SolarWinds compromise and the Microsoft email breach, so not exactly script kiddies.

The attack chain is fairly sophisticated. Victims were reached through three routes: legitimate websites that had been quietly compromised, convincing fakes dressed up to look like popular sites, and a supply chain attack targeting the Plerdy SEO Tracker. Once a user lands on a malicious page, JavaScript fires off an exploit combining CVE-2024-27834 with a WebKit remote code execution flaw. The end result is cookie theft — which in practice means session hijacking and potential access to whatever accounts the victim was logged into.

Federal agencies have been told to apply the relevant patches by November 2026, which is a generous deadline given the patches have existed for over a year. If you're running any Apple device and haven't updated since before May 2024, that's the more urgent problem.