iPhone users need to be on alert, as cybercriminals are using a new “smishing” campaign to collect user data.
Apple IDs are especially vulnerable and of use to criminals due to their “widespread use,” according to a press release from Broadcom.
“Smishing is a social engineering attack that uses fake mobile text messages to trick people into downloading malware, sharing sensitive information or sending money to cybercriminals,” IBM states.
Broadcam’s release said that Apple ID “offers access to a vast pool of potential victims. These credentials are highly valued, providing control over devices, access to personal and financial information, and potential revenue through unauthorized purchases.”
“Additionally, Apple’s strong brand reputation makes users more susceptible to trusting deceptive communications that appear to be from Apple, further enhancing the attractiveness of these targets to cybercriminals.”
These malicious attacks are occurring through email and increasingly through SMS.
Broadcom shared a recent example in which cybercriminals attempted to collect information through a malicious SMS that looked like this:
“Apple important request iCloud: Visit signin[.]authen-connexion[.]info/icloud to continue using your services.”
According to Broadcom, smishing actors typically restrict access to their malicious websites to users on mobile browsers to avoid detection by monitoring systems.
“However, in this instance, the malicious website is accessible from both desktop and mobile browsers. To add a layer of perceived legitimacy, they have implemented a CAPTCHA that users must complete. After this, users are directed to a webpage that mimics an outdated iCloud login template,” according to Broadcom.
Broadcom recommends using Symantec Endpoint Protection Mobile, which analyzes links through SMS messages. The product also shields users from SMS phishing attempts by checking URLs in messages against the threat intelligence in Symantec WebPulse and alerts users when the links are suspicious.
Apple also shared how scammers can trick one into sharing information or giving money:
- Fraudulent emails and other messages that look like they’re from legitimate companies, including Apple.
- Misleading pop-ups and ads that say your device has a security problem.
- Scam phone calls or voicemails that impersonate Apple Support, Apple partners, and other well-known or trusted entities or individuals.
- Fake promotions that offer free products and prizes.
- Unwanted calendar invitations and subscriptions
Apple also recommended several tips on how to avoid scams that target Apple accounts and devices:
- Never share personal data or security information, such as passwords or security codes, and never agree to enter them into a webpage that someone directs you to.
- Protect your Apple ID. Use two-factor authentication, always keep your contact information secure and up to date, and never share your Apple ID password or verification codes with anyone. Apple never asks for this information to provide support.
- Never use Apple Gift Cards to make payments to other people.
- Learn how to identify legitimate Apple emails about your App Store or iTunes Store purchases. If you send or receive money with Apple Cash (U.S. only), treat it like any other private transaction.
- Learn how to keep your Apple devices and data secure.
- Download software only from sources you can trust.
- Don’t follow links or open or save attachments in suspicious or unsolicited messages.
- Don’t answer suspicious phone calls or messages claiming to be from Apple. Instead, contact Apple directly through our official support channels.
Apple also has several email contacts for reporting different types of scams, including phishing and Facetime fraud.