Ethical Hacking News
Hackers have successfully exploited a patched Apple flaw, CVE-2024-27834, to deliver information-stealing malware. The vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. Organizations are recommended to apply the necessary patches by November 18, 2026, to prevent further exploitation.
Hackers exploited a patched Apple flaw, CVE-2024-27834, to deliver information-stealing malware. The vulnerability is a case of improper authentication, allowing attackers to bypass Pointer Authentication. Despite the patch, threat actors have managed to exploit the vulnerability as a zero-day. The activity is attributed to APT29, a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service. Agencies are recommended to apply the necessary patches by November 18, 2026, to prevent exploitation.
The cybersecurity landscape has seen a recent development that highlights the vulnerability of even the most secure systems. Recently, hackers have successfully exploited a patched Apple flaw, CVE-2024-27834, to deliver information-stealing malware. This incident is being monitored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability in question is a case of improper authentication, which could allow an attacker to bypass Pointer Authentication and gain arbitrary read and write capability. This flaw was addressed by Apple in May 2024 with improved checks in various operating systems, including iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.
Despite the patch, threat actors have managed to exploit the vulnerability, demonstrating it as a zero-day at the Pwn2Own Vancouver hacking contest held in March. The addition of CVE-2024-27834 to the KEV catalog follows a report from Sekoia that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harvesting browser and device data.
The activity has been attributed to APT29 (aka Cozy Bear and Midnight Blizzard), a state-sponsored hacking group affiliated with Russia's Foreign Intelligence Service, with "moderate to high confidence." The attacks involve three initial access pathways – compromised legitimate websites, fake sites masquerading as popular websites, and a supply chain attack aimed at Plerdy SEO Tracker – to serve malicious JavaScript that triggers the vulnerability and ultimately deploy the information-stealing payload after profiling the visitor's device.
The zero-click exploit chain combines CVE-2025-43529, a remote code execution flaw in WebKit, and CVE-2025-43529, the pointer authentication codes (PACs) bypass, to execute a JavaScript payload designed for browser cookie theft. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary patches by November 18, 2026.
This incident highlights the importance of staying vigilant and applying patches to prevent exploitation. It also underscores the need for continuous monitoring and vigilance in the face of emerging threats. As the cybersecurity landscape continues to evolve, it is essential for organizations to remain proactive in addressing vulnerabilities and protecting their systems from exploitation.
Related Information:
https://www.ethicalhackingnews.com/articles/Hacking-Exploited-The-Case-of-the-Exploited-Apple-Flaw-and-the-Threat-of-Malware-Delivery-ehn.shtml
https://thehackernews.com/2026/11/hackers-exploit-patched-apple-flaw-to.html
https://hackerfeeds.com/news/hackers-exploit-patched-apple-flaw-to-deliver-info-stealing-malw-g7inks
https://utopiats.com/blog/hackers-exploit-patched-apple-flaw-to-deliver-info-stealing-malware-cisa-says
https://nvd.nist.gov/vuln/detail/CVE-2024-27834
https://www.cvedetails.com/cve/CVE-2024-27834/
https://nvd.nist.gov/vuln/detail/CVE-2025-43529
https://www.cvedetails.com/cve/CVE-2025-43529/
https://www.threatintelreport.com/articles/threat-actor-profile-apt29/
https://attack.mitre.org/groups/G0016/
Published: Thu Nov 5 01:07:54 2026 by llama3.2 3B Q4_K_M
