This Week in Security: iCloud Spoofing, AI-Chat Data Collection and Phishing
Summary
SecurityWeek’s roundup covers iCloud email-spoofing flaws, an adblocker collecting AI conversations, phishing and espionage, Cloudflare data exposure, Android app vulnerabilities, and major security advisories.
Key points
- Microsoft’s 2026 report says phishing rose to 23% of initial access in its incident-response cases, while median time from vulnerability discovery to weaponization fell below 24 hours.
- Apple fixed two iCloud flaws that let attackers send spoofed emails passing SPF, DKIM and DMARC checks; the researcher received a $15,000 bounty.
- Researchers say Poper Blocker collected browsing history and conversations from several AI services after users accepted data sharing; its collection logic could be changed remotely.
- Cloudflare patched a Containers flaw that exposed residual data from other customers’ storage blocks; researchers recovered data in 18 of 24 placements, and Cloudflare found no evidence of exploitation.
- Proofpoint reported that China-aligned TA419 used fake AI-policy outreach and an adversary-in-the-middle sign-in proxy to steal session cookies from targeted experts.
- Two former US airmen were sentenced for business email compromise attacks that diverted more than $2.4 million from victims.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering vulnerability disclosures, security research, cyberattacks, and law-enforcement outcomes.
- Impact
- Reported developments include phishing increases and ransomware activity; more than 100 Kiteworks security advisories, including critical flaws that may enable account takeover, code execution, or access to internal network resources; iCloud spoofing vulnerabilities that allowed messages from arbitrary icloud.com addresses to pass email authentication checks; collection of users’ browsing histories and AI conversations by Poper Blocker after users accepted data sharing; Android application flaws affecting location privacy and account security; business email compromise attacks that diverted more than $2.4 million from victims; and a Cloudflare Containers flaw that exposed residual data from other customers’ storage blocks. Cloudflare reported no evidence of malicious exploitation, and the Android AI-generated findings require human review.
MITRE ATT&CK
People
Chijioke Timothy OdimegwuOne of two men sentenced for business email compromise attacks that redirected victim payments.Harafat MogajiOne of two men sentenced for business email compromise attacks that redirected victim payments.Oren YomtovAccomplish researcher who reported the Cloudflare Containers data-exposure flaw.Timo LonginSEC Consult researcher who disclosed the iCloud email-spoofing vulnerabilities.
Threat Actors
Vendors
AnthropicThe group also posed as an Anthropic employee in February 2026.AppleBoth stemmed from differences in how two parts of Apple’s outgoing mail pipeline parsed messages, which let a forged From header slip past sender verification.CloudflareVulnerability let Cloudflare Containers users peek at other customers’ dataKiteworksKiteworks publishes over 100 security advisories in a single dayMicrosoftMicrosoft threat report sees phishing triple as exploit windows shrink
Products
ChatGPTextension with more than 2 million users, collects full browsing history and conversations from ChatGPT, Claude, Gemini and Google’s AI Mode once users are nagged into accepting data sharing.Claudeextension with more than 2 million users, collects full browsing history and conversations from ChatGPT, Claude, Gemini and Google’s AI Mode once users are nagged into accepting data sharing.ContainersVulnerability let Cloudflare Containers users peek at other customers’ dataCore platformKiteworks published over 100 security advisories on September 30, covering its Core platform, Email Protection Gateway, Secure Data Forms, and MFT Server.Email Protection Gateway (EPG)Kiteworks published over 100 security advisories on September 30, covering its Core platform, Email Protection Gateway, Secure Data Forms, and MFT Server.Geminiwith more than 2 million users, collects full browsing history and conversations from ChatGPT, Claude, Gemini and Google’s AI Mode once users are nagged into accepting data sharing.Google ChromeBay Area Labs researchers found that Poper Blocker, a featured Chrome adblocker extension with more than 2 million users, collects full browsing history and conversations from ChatGPT, Claude, Gemini and Google’s AIiCloudSmuggled headers turned iCloud into an email spoofing toolMFT ServerKiteworks published over 100 security advisories on September 30, covering its Core platform, Email Protection Gateway, Secure Data Forms, and MFT Server.Microsoft 365 Apps for EnterpriseTargets who replied to the initial benign outreach were sent to a fake OneDrive page that passes the Microsoft 365 sign-in through an adversary-in-the-middle (AitM) proxy, capturing session cookies even when MFA is used.Microsoft OneDriveTargets who replied to the initial benign outreach were sent to a fake OneDrive page that passes the Microsoft 365 sign-in through an adversary-in-the-middle (AitM) proxy, capturing session cookies even when MFA is used.OsmAndExamples include an OsmAnd flaw that let any installed app (even one with no permissions) silently change the navigation app’s settings to leak the user’s location and routes, and two Wikipedia app bugs that chain intoPoper BlockerPoper Blocker’s hidden interpreter siphons AI conversationsSandboxesCloudflare has patched a flaw in Containers (and Sandboxes, which is built on it), reported by Accomplish researcher Oren Yomtov, that let a Workers Paid customer recover leftover data from disk blocks other customers’Secure Data FormsKiteworks published over 100 security advisories on September 30, covering its Core platform, Email Protection Gateway, Secure Data Forms, and MFT Server.Wikipedia appsilently change the navigation app’s settings to leak the user’s location and routes, and two Wikipedia app bugs that chain into account takeover through a malicious deeplink.