CISA has added CVE-2024-27834, an authorization bypass vulnerability in Apple operating systems, to its Known Exploited Vulnerabilities catalog.
Originally patched by Apple in May 2024, the flaw is now linked to campaigns attributed to the APT29 group, which leverage compromised websites and SEO trackers to facilitate data theft.
Federal agencies are mandated to complete patching by November 18, 2026.
This serves as a reminder to ensure all dependencies and system updates are current.
How attacks are carried out
According to reports, the APT29 group is allegedly behind these actions. The perpetrators use various methods to trap users, including:
- Hacked legitimate websites.
- Fake websites that impersonate other services.
- Attack on the Plerdy SEO Tracker service, which affects those who visit pages that use it.
These attacks combine Apple's security flaw with previously known issues in popular browsers, such as Safari and Google Chrome. The goal of the attackers is to steal browsing data, known as cookies, which can give them access to users' accounts.
The importance of updating devices
Apple had identified the problem and released the necessary fixes as early as May 2024. However, the attacks continue, as perpetrators exploit devices that have not been upgraded to the latest software version.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Personal data of 851.000 people from Harvard University leaked
↗
CISA has asked US federal agencies to have these updates applied to their devices by November 18, 2026. This directive highlights how important it is for every user to keep their software up to date in order to remain protected from such risks.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)