Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

What happened

Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says  Ravie Lakshmanan  Nov 05, 2026 Vulnerability / Cyber Espionage The U.S. Apple is a software and consumer electronics company based in Cupertino.

The vulnerability was demonstrated as a zero-day (a flaw already being used in attacks before a fix exists) at the Pwn2Own (computer hacking contest) Vancouver hacking contest held in March that year.

The addition of CVE-2024-27834 (the public catalogue number for a specific software flaw) to the KEV catalog follows a report from Sekoia that threat actors (the person or group behind an attack) possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware (software written to damage a system or steal from it) capable of harvesting browser and device data. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication.

It was addressed by Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The activity has been attributed to APT29 (aka Cozy Bear and Midnight Blizzard), a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with "moderate to high confidence."