Hackers Exploit Patched Apple Flaw: Info-Stealer, CISA Says

What happened

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday, after reports of active exploitation. Apple fixed the flaw in May 2024, so this is an old bug being used against devices that never updated. The source report is on The Hacker News.

The flaw is an improper authentication issue. An attacker who already has arbitrary read and write capability can use it to bypass Pointer Authentication. It was first demonstrated as a zero-day at the Pwn2Own Vancouver contest in March 2024.

The KEV listing follows a Sekoia report. It says threat actors possibly linked to Russia used previously patched bugs in Safari and Google Chrome to deliver malware that harvests browser and device data.

Who is affected and which versions fix it

Apple addressed the bug with improved checks in the releases below. Your devices should be on these builds or later:

The attacks also touch Chrome. Browsers on any platform should be on the current release.

Severity and active exploitation

The CVSS score is 5.5, which is medium. Do not let that number lower your guard. Active exploitation is the reason CISA listed it.

The activity is attributed to APT29, also known as Cozy Bear and Midnight Blizzard. It is a state-sponsored group tied to Russia's Foreign Intelligence Service. The attribution carries "moderate to high confidence."

There are three initial access paths:

• Compromised legitimate websites.

• Fake sites that copy popular websites.

• A supply chain attack aimed at Plerdy SEO Tracker.

Each path serves malicious JavaScript that triggers the vulnerability. The code profiles the visitor's device first, then deploys an information-stealing payload. The zero-click exploit chain pairs CVE-2025-43529, a WebKit remote code execution flaw, with a pointer authentication bypass. It runs a JavaScript payload built for browser cookie theft.

What to do now

CISA recommends that Federal Civilian Executive Branch agencies apply the necessary patches by November 18, 2026. Private teams can use the same date as a sensible target.

1. Update every Apple device and browser

On iPhone and iPad, open Settings, then General, then Software Update. On a Mac, check the build and install updates from the terminal:

sw_vers
softwareupdate --list
sudo softwareupdate --install --all

Check the Safari version separately, since it may ship apart from the OS:

defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString

2. Check your fleet

If you run osquery, these two queries list macOS and Safari versions. Compare the output with the table above.

SELECT name, version, build FROM os_version;
SELECT name, bundle_short_version FROM apps WHERE name = 'Safari.app';

3. Look for the Plerdy tracker on your own sites

The supply chain path targeted Plerdy SEO Tracker. If you publish websites, search your code and templates for it:

grep -ril "plerdy" /var/www/

A hit does not prove compromise. It tells you to review the script source and compare it with the vendor's official copy.

4. Treat stolen cookies as the real risk

The payload is built to steal browser cookies. On a device that ran an old build, sign out of sensitive web accounts and revoke active sessions. Rotate passwords for anything high value.

Worked example: 20 Macs, mixed ages

Say a small office has 20 Macs. You run the osquery check and find 3 on a build older than macOS Sonoma 14.5.

What IT and security learners can take from this

This case shows why patch status matters more than a severity score. A medium bug became a state-backed attack tool. It also shows why asset inventory, version checks and session revocation are core defender skills. If you want to build those skills toward a recognized credential, the CompTIA CySA+ CS0-003 voucher covers threat analysis and vulnerability management. For a related case on stolen credentials, read our post on fake GitHub security tools that push infostealers.

Browse more options in our cybersecurity certification category. Vouchers arrive by email within 12 hours.

Sources

• Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says