CISA lists an old Apple bug as exploited, and a spy campaign is using it on phones that missed updates

CISA added a 2024 Apple bug to its list of exploited flaws on Wednesday. The same day, Sekoia published research on a watering-hole campaign that uses it, which it ties to Russia’s APT29. The campaign served exploits to phones visiting hacked or cloned websites. Opening the page was enough.

Every bug in the campaign was patched before it began. The phones it hits are the ones that stopped updating, which most companies still have somewhere.

Every exploit in this campaign was already patched. It works on the phones that stopped taking updates.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Old Apple bug added to CISA’s exploited list

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4, with a November 18 deadline for federal agencies. It is a pointer authentication bypass that Apple fixed in May 2024 in iOS 17.5, iOS 16.7.8, macOS Sonoma 14.5 and Safari 17.5.

Sekoia says the campaign used three exploit chains. One, aimed at iOS 16.7, pairs CVE-2025-43529 with CVE-2024-27834 to steal cookies. A second, the DarkSword kit, targets iOS 18.5 and takes messages, keychain data and photos. A third targets Chrome 139 to 145 on Android through CVE-2026-3910 and CVE-2025-27038 and takes Chrome cookies, saved passwords and Wi-Fi passwords.

The pages came from three sources: hacked sites in the U.S. and Europe, lookalike sites that proxied real ones, and a week-long compromise of the Plerdy analytics script, from August 27 to September 3, that loads on thousands of mostly Ukrainian sites.

iPhones on old iOS and Android phones on old Chrome

Sekoia says none of the chains works on a fully updated phone. The exposed group is phones that have not taken an update, or cannot. Apple’s CVE record for the first bug in the iOS 16 chain lists fixes only in iOS 18.7.3 and iOS 26.2, so iPhones that cannot go past iOS 16 have no listed fix for it.

Stolen cookies matter beyond the phone. Sekoia notes they can let an attacker reuse signed-in sessions, including webmail.

Find the phones that stopped updating

• Pull an OS-version report from your MDM and list every iPhone and iPad below the current release for its model. Apple’s October 28 updates set those floors.
• Retire or block corporate email and SSO on iPhones that cannot run anything newer than iOS 16.
• Check Chrome on managed Android phones. Versions before 146.0.7680.75 lack Google’s fix for the Chrome bug in the Android chain.
• Sign out sessions and reset passwords for anyone whose phone turns up far behind, since cookie theft leaves no prompt.

Details

• CVE-2024-27834: Apple improper authentication (pointer authentication bypass). Fixed in Safari 17.5, iOS and iPadOS 16.7.8 and 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. KEV added November 4, 2026, due November 18; forensic triage not required.
• Chains (Sekoia): A: CVE-2025-43529 + CVE-2024-27834, iOS 16.7, cookie theft. B: DarkSword, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520, iOS 18.5, full data theft. C: CVE-2026-3910 + CVE-2025-27038, Android Chrome 139 to 145 except 143.
• Update floors: Apple’s October 28 releases covered iOS 27.2 and older-model updates down to iOS 18.7.11 (our October 28 brief).

Hunt / verify

• Block the domains Sekoia published at your DNS or proxy and search past logs for them: flux-telemetry[.]com, clouds-stacks[.]com, starx-net[.]com, america250[.]holiday, theowo[.]club.
• If your own websites load the Plerdy tracker, treat August 27 to September 3 as a supply-chain incident window and review what that script served.

Source: Sekoia report; CISA KEV alert, November 4

Sources

• Sekoia: Poisoned Source, APT29 watering holes target mobile devices with n-day exploits (November 4, 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (November 4, 2026)
• CISA: Known Exploited Vulnerabilities Catalog
• Apple: About the security content of Safari 17.5
• The Hacker News: APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
• CVE.org: CVE-2024-27834

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].