US cyber officials say hackers are using an old Apple WebKit bug in attacks that steal browser cookies from iPhones.