Apple has publicly confirmed that cyber attackers, identified with moderate to high confidence as Russia’s APT29 (also known as Cozy Bear or Midnight Blizzard), have been exploiting a previously patched vulnerability — CVE-2024-27834 — to install information-stealing malware on devices. Despite the flaw already being addressed by Apple in May 2024, its inclusion in the U.S. CISA’s Known Exploited Vulnerabilities catalog signals active, ongoing misuse.
Details of the Exploit
The flaw at the center of the attack, CVE-2024-27834, is a medium-severity issue (CVSS score 5.5) stemming from improper authentication. It allows attackers with arbitrary read/write abilities to circumvent Pointer Authentication defenses. Apple’s patches that remedied the vulnerability were released in May 2024 across multiple platforms including iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.
Attackers are combining this flaw with a remote code execution bug in WebKit, CVE-2025-43529, to achieve a zero-click exploit chain capable of stealing browser cookies and device data. Initial access is achieved through three different paths: compromised legitimate websites, fake sites impersonating trusted ones, and a supply chain compromise involving Plerdy SEO Tracker. Malicious JavaScript is served via these vectors, probing visitor devices before triggering the vulnerability to deploy the malware.
Official Response & Guidance
The Cybersecurity and Infrastructure Security Agency (CISA) has now added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog. The move comes after a report by threat intelligence firm Sekoia warned that these patched flaws are still being abused in the wild to target users of Apple devices and browsers.
Focusing on mitigating the ongoing threat, CISA has directed all Federal Civilian Executive Branch agencies to apply Apple’s patches by November 18, 2026. The recommendation underscores the urgency of updating software to close this active exploit vector.
The hack reveals overlapping vulnerabilities in Apple’s software and the enduring challenge of securing supply chains. Even when bugs are fixed, attackers find ways to exploit unpatched systems, impersonate trusted sites, or introduce malicious components into third-party services.
Beyond just Apple users, this case illustrates a wider lesson in cybersecurity: patching alone is not enough. Organizations must validate patch deployment, monitor for odd network activity, and guard against supply chain or identity-based attacks that can bypass standard protections. Keep software current, vet everything from installed extensions to third-party scripts, and assume that any web-facing component could be an entry point.
What this means is that cybersecurity isn’t a finish line — it’s a continual process. This exploit chain combines old and new flaws, trust-based breaches, and advanced evasion techniques. As defenses improve, so do the offensive strategies. What to watch next: whether Apple’s long-term updates prevent future bypasses, how supply chain attacks continue evolving, and what additional guidance federal agencies provide to stay ahead.
