A new cyberattack is targeting iPhone users, with criminals attempting to obtain individuals’ Apple IDs through a “phishing” campaign, security software company Symantec said in an alert Monday.
Cybercriminals are sending text messages to iPhone users in the US that appear to come from Apple, but are in fact intended to steal victims’ personal data.
“Phishing actors continue to target Apple IDs due to their widespread use, which provides access to a large number of potential victims,” Symantec said. “These credentials are highly valuable, offering control over devices, access to personal and financial information, and potential revenue through unauthorized purchases.”
Consumers are also more likely to trust communications that appear to come from a trusted brand like Apple, warned Symantec, which is owned by Broadcom, a maker of semiconductors and infrastructure software.
The malicious text messages appear to come from Apple and encourage recipients to click on a link and log in to their iCloud accounts. For example, a phishing text might say: “Apple important iCloud request: visit to sign in[.]authenticate connection[.]info/icloud to continue using your services.” Recipients are also asked to complete a CAPTCHA to appear legitimate, before being taken to a fake iCloud login page.
Such cyberattacks are often called “smishing,” where criminals use fake text messages from supposedly trustworthy organizations instead of email to trick people into sharing personal information, such as account passwords and credit card details.
How to protect yourself
Be careful when opening text messages that appear to be sent by Apple. Always check the source of the message: if it comes from a random phone number, the iPhone maker is almost certainly not the sender. iPhone users should also avoid clicking on links that invite people to access their iCloud account; instead, go directly to login pages.
“If you are suspicious of an unexpected message, phone call, or request for personal information, such as your email address, phone number, password, security code, or money, you should assume it is a scam and contact the company directly if necessary,” Apple said in a message about avoiding scams.
Apple encourages users to always enable two-factor authentication for Apple ID for added security and to make it harder to access your account from another device. It’s “designed to help ensure that you’re the only person who can access your account,” Apple says.
Apple adds that its own support staff will never send users a link to a website asking them to sign in or enter your password, device passcode, or two-factor authentication code.
“If someone claiming to be from Apple asks you for any of the above, they are a scammer engaged in a social engineering attack. Hang up the call or otherwise break contact with them,” the company said.
The Federal Trade Commission also recommends setting your computer and mobile phone to automatically update security software.