CONNECT WITH US
Cyber Security

Cyber Security

Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

The Hacker News logo

Published on

Add as a preferred source on Google
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.

The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication.

It was addressed by Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held in March that year.

The addition of CVE-2024-27834 to the KEV catalog follows a report from Sekoia that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data.

The activity has been attributed to APT29 (aka Cozy Bear and Midnight Blizzard), a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with "moderate to high confidence."

The attacks involve three initial access pathways – compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker – to serve malicious JavaScript that triggers the vulnerability and ultimately deploy the information-stealing payload after profiling the visitor's device.

The zero-click exploit chain combines CVE-2025-43529 , a remote code execution flaw in WebKit, and CVE-2025-43529, the pointer authentication codes (PACs) bypass, to execute a JavaScript payload designed for browser cookie theft.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.