Hackers have begun actively exploiting an old vulnerability in Apple systems to compromise browsers and steal credentials. This flaw affects users of iPhone, Mac, and iPad who have not installed the updates released in May 2024, according to The Hacker News.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the code CVE-2024-27834 to its catalog of actively exploited vulnerabilities after confirming new attacks. This vulnerability was first presented during the Pwn2Own Vancouver competition in March 2024.
Although Apple released fixes for iOS, iPadOS, macOS, tvOS, watchOS, and Safari two months later, devices without updates remain vulnerable. This can happen either due to user forgetfulness or the need to keep older versions for compatibility with legacy software.
To spread the attacks, criminals compromised the Plerdy SEO Tracker tool, which administrators use to monitor website traffic and visits. Furthermore, they created fake pages and infected legitimate portals.
The infection occurs while using Safari. JavaScript code detects the device model and checks if the system is outdated. Upon detecting a vulnerable version, the exploit runs without requiring any action from the victim, such as clicking a link or downloading files.
The primary goal of the attackers is to capture session cookies—small pieces of data stored in the browser that maintain the user's connection to services without requiring password re-entry upon each access. With these records, criminals can clone the victim's session on another computer and gain access to email and work platforms. This method also allows bypassing two-factor authentication (2FA), which usually requires a temporary code in addition to a password.
The attacks are linked to the APT29 group, also known as Cozy Bear or Midnight Blizzard, which is associated with Russia's Foreign Intelligence Service. CISA also warns users in Brazil: Apple devices that have not yet received the patches remain susceptible to exploitation of this vulnerability. Therefore, it is crucial to check for pending updates on iPhone, iPad, or Mac and install them to protect devices. The article about the old Apple vulnerability being reused to steal data from iPhones first appeared in Olhar Digital.



