CVE-2024-27834 WebKit Flaw Exploited by APT29 to Steal iPhone, iPad and Mac Browser Sessions
A WebKit vulnerability in Apple devices, originally demonstrated at Pwn2Own Vancouver in March 2024 and patched by Apple in May 2024, is now being actively exploited according to The Hacker News. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after confirming new attacks targeting unpatched iOS, iPadOS, macOS, tvOS, watchOS and Safari devices. The campaign is attributed to APT29 (also known as Cozy Bear or Midnight Blizzard), linked to Russia's Foreign Intelligence Service. Attackers compromised the Plerdy SEO Tracker tool and set up malicious or infected websites to deliver a zero-click JavaScript exploit against outdated devices browsing with Safari.
Entenda a falha
A vulnerabilidade
CVE-2024-27834 is a vulnerability in WebKit, the browser engine used by Safari and Apple's operating systems. It affects iOS, iPadOS, macOS, tvOS, watchOS and Safari. The articles do not give the flaw class or exact version numbers. According to the story, an attacker only needs the victim to visit a compromised or malicious site in Safari on an outdated device; no click or download is required. The attacker's goal is stealing browser session cookies. Devices without the May 2024 Apple updates are affected; those updates are the fix.
Como funciona
A victim browsing with Safari lands on a compromised or malicious site, including pages that load the compromised Plerdy SEO Tracker. Injected JavaScript fingerprints the device model and checks whether the OS version is outdated. If it is vulnerable, the script silently triggers the exploit for CVE-2024-27834 with no user interaction. The articles do not describe the internal WebKit step where it fails. The result is theft of session cookies, which let attackers clone the session on another machine, reach email and work platforms and bypass 2FA.
Por que é vulnerável
The articles do not state the root cause of the flaw in WebKit. They only say Apple fixed it in May 2024 and that the risk remains for devices that never installed those updates, whether through neglect or because users keep old versions to run legacy software.
Como foi descoberta
The flaw was demonstrated at Pwn2Own Vancouver in March 2024, and Apple shipped fixes about two months later, in May 2024. Per The Hacker News, as relayed by Olhar Digital, CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after confirming new attacks. The campaign is attributed to APT29 (Cozy Bear, Midnight Blizzard), linked to Russia's Foreign Intelligence Service.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The articles show a working exploit is in use in attacks: a JavaScript exploit delivered through compromised sites that targets outdated Safari devices. No article says a copy has been published, so it is treated as private. Because it is already exploited in the wild by APT29, any unpatched device should be updated immediately.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 16:18.
Detalhes técnicos
The attack chain begins when a victim visits a compromised or malicious site through Safari. Injected JavaScript fingerprints the device model and checks for an outdated, vulnerable OS version; if found, it silently triggers the CVE-2024-27834 exploit without requiring any click or download. The primary goal is theft of browser session cookies, which allow attackers to clone the victim's session on another machine, access email and work platforms, and bypass two-factor authentication (2FA) entirely.
Remediação
Users should immediately check for and install pending updates on iPhone, iPad and Mac devices, as only unpatched systems (those without the May 2024 fixes) remain vulnerable to this exploit.
Linha do tempo
-
CVE-2024-27834 WebKit Flaw Exploited by APT29 to Steal iPhone, iPad and Mac Browser Sessions
ler a análise desta fonte ocultar
A WebKit vulnerability in Apple devices, originally demonstrated at Pwn2Own Vancouver in March 2024 and patched by Apple in May 2024, is now being actively exploited according to The Hacker News. CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog after confirming new attacks targeting unpatched iOS, iPadOS, macOS, tvOS, watchOS and Safari devices. The campaign is attributed to APT29 (also known as Cozy Bear or Midnight Blizzard), linked to Russia's Foreign Intelligence Service. Attackers compromised the Plerdy SEO Tracker tool and set up malicious or infected websites to deliver a zero-click JavaScript exploit against outdated devices browsing with Safari.
Technical Details
The attack chain begins when a victim visits a compromised or malicious site through Safari. Injected JavaScript fingerprints the device model and checks for an outdated, vulnerable OS version; if found, it silently triggers the CVE-2024-27834 exploit without requiring any click or download. The primary goal is theft of browser session cookies, which allow attackers to clone the victim's session on another machine, access email and work platforms, and bypass two-factor authentication (2FA) entirely.
Remediation
Users should immediately check for and install pending updates on iPhone, iPad and Mac devices, as only unpatched systems (those without the May 2024 fixes) remain vulnerable to this exploit.