Watch out, hackers are abusing Apple account notifications to distribute malware, steal money and data

Date:
Mon, 20 Apr 2026 12:33:01 +0000

Description:
Researchers found a new callback phishing campaign abusing Apple's email notification system.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Pro Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Become a Member in Seconds Unlock instant access to exclusive member features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are
now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Scammers abuse Apples email domain to send callback phishing messages Technique exploits Apple ID creation fields to embed fake purchase alerts Victims tricked into calling scammers, who then steal sensitive data or gain remote access Scammers have found a way to abuse Apple s email notification system to deliver phishing messages and trick people into giving away sensitive data and system access.

Recently, people started receiving emails from the email.apple.com domain, notifying them of a $899 iPhone purchase via PayPal. The email also shared a phone number for the victims to call, to cancel the order. These are your usual, run-of-the-mill callback phishing emails that trick the victim into calling the provided phone number in panic. While on the phone, the scammers convince the victim to share sensitive information, or grant remote access to their computer. That way, the scammers are able to make wire transfers and ultimately clear peoples bank accounts. Article continues below You may like
A devious new Apple Pay scam is hitting millions heres how to stay safe
Watch out for suspicious Microsoft Azure Monitor alerts it could be this shifty new callback phishing attack These fake iCloud deletion emails are quietly stealing more than just login details Mailing list abuse What makes this campaign stand out is the use of Apples email domain. What the scammers really did was abuse the Apple ID creation process. When creating a new account, the first and last name fields can accept so many characters that
the crooks can fit an entire phishing message in there.

Then, they change the accounts shipping information, which triggers the Apple security alert. However, that email still doesnt land in the victims email, but instead - in the scammers. The final step is to use a mailing list to distribute the emails to multiple targets.

The mailing list technique is also nothing new. Weve seen it numerous times
in the past, with major names such as Google , Amazon , and Microsoft , all being abused the same way. Apple was used the same way in September last
year, when crooks abused iCloud Calendar invites to achieve the same results.

Generally, all emails coming from reputable brands and carrying a sense of urgency should be treated with high skepticism. Being asked to call a phone number listed in the email is another red flag. The best way to double-check possible problems is to navigate directly to the company website and look for contact information there. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features
and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/watch-out-hackers-are-abusing-apple-acc ount-notifications-to-distribute-malware-steal-money-and-data


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)