Apple Flaw: Attackers Are Still Using It Today

Overview

A vulnerability that Apple patched in 2024 has now been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue after evidence emerged that threat actors are actively exploiting it. The vulnerability, CVE-2024-27834, affects multiple Apple operating systems and was originally demonstrated as a zero-day during the Pwn2Own Vancouver hacking competition in March 2024. Apple addressed the vulnerability in May 2024. More than two years later, attackers are reportedly incorporating it into an exploit chain used to deliver information-stealing malware. This is an important reminder that a vulnerability does not stop being dangerous simply because its patch is old.

The Vulnerability Was Patched — But Not Everyone Patched

CVE-2024-27834 was addressed by Apple in updates covering several operating systems, including iOS, iPadOS, macOS, tvOS, watchOS and Safari. The flaw involves improper authentication that can allow an attacker with arbitrary read and write capabilities to bypass Apple’s Pointer Authentication mechanisms. By itself, that may sound highly specialised. In an exploit chain, however, a low- or medium-severity vulnerability can become extremely valuable when combined with another weakness. That appears to be what is happening here.

From Website Visit to Information Theft

According to the reported activity, attackers associated with APT29, also known as Cozy Bear and Midnight Blizzard, have used several methods to deliver malicious JavaScript to targeted visitors.

These include:

• Compromised legitimate websites
• Fake websites designed to imitate popular services
• A supply-chain compromise involving the Plerdy SEO Tracker

The malicious JavaScript can profile the visitor’s device and determine whether it is an appropriate target. This is a significant development in modern web-based attacks. The victim does not necessarily need to download a suspicious application or open an obvious malicious attachment. Simply visiting a compromised or malicious website can become the starting point for the attack.

The Zero-Click Element

The reported attack chain is particularly concerning because it is described as zero-click. The objective is to combine multiple vulnerabilities so that malicious code can execute without requiring the victim to deliberately approve an installation or interact with a suspicious prompt. The resulting payload is designed to steal browser information, including cookies. Browser cookies can be extremely valuable to attackers because they may allow access to authenticated sessions without requiring the victim’s password to be entered again. This turns a browser compromise into an identity-security problem.

The Supply Chain Is Part of the Attack Surface

One of the reported delivery mechanisms involves a supply-chain attack against Plerdy SEO Tracker. This is an important lesson for organisations using third-party web services. A company may maintain fully patched laptops, enforce MFA and use endpoint security — yet still encounter malicious content because a trusted website or third-party service has been compromised. The attack surface therefore extends beyond the organisation’s own infrastructure.

It includes:

Employees → browsers → websites → third-party scripts → SaaS services → software supply chain

Every trusted dependency creates another potential path into the environment.

Why Browser Cookies Matter

Traditional security awareness often focuses on protecting passwords. Modern attacks increasingly target the authentication session itself. If an attacker obtains a valid session cookie, they may be able to operate within an already authenticated session without needing to know the user’s password. This is why controls such as MFA, while essential, should not be considered the final layer of identity protection. Organisations should also consider:

• Conditional Access
• Device compliance
• Session controls
• Browser security
• Token and session monitoring
• Endpoint detection
• Privileged access controls
• Rapid session revocation following suspected compromise

The goal is to make a stolen session less useful and reduce the time an attacker can operate with it.

CISA KEV Changes the Priority

The addition of CVE-2024-27834 to CISA’s Known Exploited Vulnerabilities catalogue is significant. KEV is not simply another vulnerability list. It indicates that a vulnerability has evidence of exploitation and should therefore receive elevated remediation priority. For organisations, the practical lesson is straightforward:

Do not prioritise vulnerabilities purely according to age or CVSS score. Prioritise vulnerabilities according to actual exploitation risk.

A vulnerability from 2024 can suddenly become more urgent than a newly disclosed vulnerability if attackers are actively using it.

Patch Management Must Include Asset Verification

This incident also highlights a common weakness in enterprise patch management. An organisation may have a policy stating that Apple security updates must be installed within a particular timeframe. That does not necessarily mean every device is actually patched.

Organisations need to verify:

• Which Apple devices are present?
• Which operating-system versions are installed?
• Which devices are unsupported?
• Which devices have missed security updates?
• Are personally owned devices accessing corporate resources?
• Are browsers and applications also current?
• Can compromised devices be detected and isolated?

For organisations using Microsoft 365, Intune or other endpoint-management platforms, Apple device compliance should form part of the broader identity and access strategy. A device that cannot demonstrate an acceptable security posture should not automatically receive the same level of access as a trusted, fully managed endpoint.

Expert in the Cloud Insight

The Apple vulnerability demonstrates an uncomfortable reality in modern cybersecurity:

“Patched” and “protected” are not always the same thing.

Apple fixed CVE-2024-27834 more than two years ago. Yet attackers can still use vulnerabilities like this when vulnerable devices remain in the wild, particularly when the flaw forms part of a larger exploit chain. The lesson for organisations is therefore bigger than simply updating iPhones and Macs. Security teams need to continuously verify the security posture of the devices that access corporate resources, understand the third-party services those devices interact with, and rapidly respond when a previously known vulnerability becomes actively exploited. A vulnerability can be old. The attack using it can be brand new. And that is why vulnerability management must be driven by exploitation intelligence, not just patch age or severity scores.