A US agency says hackers are using an Apple flaw fixed in 2024 to steal browser data from devices that never updated.
A security hole Apple fixed in May 2024 is being used in real attacks right now. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its list of known exploited flaws on Wednesday. The attacks aim to install malware that steals browser and device data. Devices that skipped the update are the targets.
The flaw is tracked as CVE-2024-27834. It affects a built-in protection called Pointer Authentication. An attacker who already has a certain level of access to a device's memory could get around that protection. CISA rates the flaw as medium severity, with a score of 5.5. It was first shown off as a zero-day (a flaw unknown to the maker) at the Pwn2Own Vancouver hacking contest in March 2024.
Security firm Sekoia reported that the attackers also used older, already patched flaws in Safari and Google Chrome. Sekoia ties the activity to APT29, also called Cozy Bear and Midnight Blizzard. That is a hacking group linked to Russia's Foreign Intelligence Service. Sekoia says it holds this view with moderate to high confidence, so it is not certain.
Victims reach the malicious code in one of three ways:
Each route serves malicious JavaScript, which is code that runs in your browser. It checks the visitor's device first. If the device is vulnerable, it triggers the flaw and installs the data-stealing software. In practice, simply visiting a booby-trapped page could be enough to put browser data, and possibly passwords, at risk.
Apple released fixes in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5 and Safari 17.5. If your devices run those versions or newer, this flaw is already closed. People who delay updates, or who use an older Chrome, are the ones exposed.
The alert box above lists the steps. The short version is to update your Apple devices and your browsers, then switch on automatic updates so you do not have to remember.
US federal civilian agencies must apply the fixes by November 18, 2026. The material does not say how many people have been hit or which sites were involved. That is not known yet. Expect more details as researchers keep tracking the campaign.
Update your iPhone, iPad, Mac and browsers now, because attackers are going after devices that skipped a fix released in May 2024.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
