CISA has added an Apple Pointer Authentication bypass, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog after a Sekoia report linked in-the-wild exploitation to APT29, the Russian group also known as Cozy Bear and Midnight Blizzard. The campaign hit iPhone and Android visitors of compromised websites, including a hijacked Ukrainian analytics script, and requires no interaction from the victim.
CISA Sets an 18 November Deadline for the Apple Pointer Authentication Bypass
CISA listed CVE-2024-27834 on Wednesday and ordered Federal Civilian Executive Branch agencies to patch by 18 November. The flaw carries a CVSS score of 5.5 and allows attackers to bypass Pointer Authentication in Apple operating systems. Apple fixed it in May 2024 in iOS 17.5, iOS 16.7.8, macOS Sonoma 14.5 and Safari 17.5. Researchers first demonstrated it as a zero-day at Pwn2Own Vancouver in March 2024.
The listing follows Sekoia’s report attributing the activity to APT29 with “moderate to high confidence.” Sekoia cited similarities to earlier APT29 watering-hole operations, overlapping infrastructure and a compromised website tied to a 2025 APT29 campaign. One source listed CVE-2025-43529 twice in the iOS exploit chain; the other reports identify the bypass as CVE-2024-27834.
Three Paths, Including the Plerdy Script, Delivered APT29 Exploit Code
Sekoia identified three ways targets reached the exploits: compromised legitimate websites, lookalike sites, and a supply-chain attack on Plerdy, a Ukrainian analytics service. Plerdy’s tracking script served attacker code between 27 August and 3 September 2026. The script runs on thousands of mostly Ukrainian sites, among them army, special forces and defense-supplier pages.
Other compromised sites included a Ukrainian gas producer, a US chemical industry trade association, a far-right European political party, a Bulgarian military-related organization and an Australian clinic. Two lookalike domains cloned America250 and Raffles London at The OWO, a hotel near the UK Ministry of Defence.
Separate Exploit Chains Targeted Older iPhones, Newer iPhones and Android Chrome
The attackers tailored the code to the device that arrived. Each chain relied on flaws that vendors had already patched, which makes the operation an n-day campaign rather than a zero-day one.
iOS 16.7 and iOS 18.5 Chains, Including the DarkSword Exploit Kit
On devices running iOS 16.7, the operators chained the WebKit remote code execution flaw CVE-2025-43529 with CVE-2024-27834 to steal cookies. Devices on iOS 18.5 faced the DarkSword exploit kit, which strings together CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510 and CVE-2025-43520. That chain collected SMS, iMessage, WhatsApp and Telegram data, Keychain passwords, location, health data and photos.
Android Chrome 139 Through 145 Exposed to CVE-2026-3910 and an Adreno Driver Bug
On Android, Chrome versions 139 through 145, except 143, were targeted with CVE-2026-3910 combined with CVE-2025-27038, a flaw in the Adreno graphics driver. The chain took cookies, saved logins, browsing history and Wi-Fi passwords.
None of the payloads installed persistence. A reboot ends the compromise, though the device is exposed again the next time it visits a booby-trapped site.
Ukraine-Linked Visitors Appear to Be the Focus of the APT29 Operation
Visitors to the infected sites running unpatched iOS or Android Chrome could have lost cookies, credentials and messaging data without clicking anything. The mix of compromised sites points toward Ukraine-related, defense and diplomatic audiences, although Sekoia says it cannot determine whether the targeting was selective.
Apple and Google have patched every flaw used in the chains, including backports to older iOS releases. The KEV entry means devices that never took those updates remain open to the same attacks, and the campaign’s reliance on months-old bugs shows how long unpatched phones stay useful to a state-linked group. The Plerdy episode adds a further pattern: a single third-party script can place exploit code in front of the visitors of thousands of otherwise unrelated sites, including those of defense suppliers that may maintain strong controls on their own infrastructure.
