> ## Content Index
> Fetch the complete content index at: https://cyfrz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Russian Group APT29 Turns an Older Apple Flaw Into a Cookie Stealing Campaign
- URL: https://cyfrz.com/russian-group-apt29-turns-an-older-apple-flaw-into-a-cookie-stealing-campaign/
- Published: 2026-11-12T07:44:23.000Z
- Updated: 2026-11-12T07:44:23.000Z
- Author: 9ino
- Tags: Espionage, News

According to F5 Labs, the Russian state sponsored group APT29, also known as Cozy Bear, is exploiting an Apple pointer authentication bypass that Apple fixed in 2024, chaining it with a WebKit remote code execution flaw. The attackers deliver information stealing malware, named AndroSnatch, AndroSnitch, and DarkSword, that grabs browser cookies. Delivery runs through compromised legitimate websites, spoofed domains, and a supply chain attack on the Plerdy SEO Tracker. Victims span Australia, Bulgaria, the Czech Republic, Ukraine, the UK, and the US across defense, energy, government, and healthcare. CISA added the flaw to its exploited list, and federal agencies must update by November 18\. For more, visit [F5 Labs](https://www.f5.com/labs/articles/weekly-threat-bulletin-november-11th-2026?ref=cyfrz.com).