Attackers Abuse Apple Account Alerts to Send Callback Phishing Emails
Summary
Attackers put callback-phishing text in Apple ID name fields, causing legitimate Apple account-change alerts to carry fake purchase warnings. The emails pass SPF, DKIM, and DMARC checks; scammers urge recipients to call them.
Key points
- Attackers create Apple IDs and place phishing text in the first and last name fields.
- Changing shipping information triggers an Apple account-change notification that includes the attacker-controlled name fields.
- BleepingComputer replicated the technique; analyzed messages were sent through Apple infrastructure and passed SPF, DKIM, and DMARC checks.
- The fake purchase alerts urge recipients to call a scammer’s number to cancel the supposed transaction.
- Scammers may try to obtain financial details or persuade victims to install remote-access software; prior callback scams have used remote access to steal funds or data or deploy malware.
- Header analysis suggests the messages may be distributed through mailing lists; the campaign resembles earlier abuse of iCloud Calendar invites.
- Apple had not responded to BleepingComputer, and the abuse was still possible at the time of publication.
Article Details
- Event Type
- Phishing campaign abusing Apple Account change notifications to send callback-scam messages through legitimate Apple email infrastructure.
- Impact
- The messages can appear authentic because they are sent from Apple infrastructure and pass SPF, DKIM, and DMARC checks. They urge recipients to call a scammer, who may seek remote access or financial information; prior callback campaigns have used remote access to steal funds, deploy malware, or steal data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
hxfedna24005@icloud[.]com | iCloud address shown in the phishing notification and described as associated with the attacker's account. |