Old Apple Flaw Back in Play: Suspected Russian Group Targets Unpatched Devices to Steal Browser Data

The US Cybersecurity and Infrastructure Security Agency (CISA) has added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The medium-severity issue (CVSS 5.5) affects multiple Apple operating systems and could let an attacker who already has read and write capability bypass Pointer Authentication. Apple fixed it in May 2024 in updates including iOS 17.5, macOS Sonoma 14.5 and Safari 17.5. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.

The listing follows a Sekoia report that threat actors possibly linked to Russia exploited previously patched flaws in Safari and Google Chrome. The activity has been attributed with "moderate to high confidence" to APT29, also known as Cozy Bear and Midnight Blizzard, a group tied to Russia's Foreign Intelligence Service. Victims were reached through three routes: compromised legitimate websites, fake sites imitating popular ones, and a supply chain attack on the Plerdy SEO Tracker. Each served malicious JavaScript that profiled the visitor's device before deploying an information-stealing payload.

The reported exploit chain is zero-click and combines a WebKit remote code execution flaw with the pointer authentication bypass to run JavaScript built to steal browser cookies. US federal civilian agencies have been told to apply patches by November 18, 2026. This article covers only the opening of the source report.