A new cyberattack is targeting iPhone users, with criminals attempting to obtain individuals’ Apple IDs in a “phishing” campaign, security software company Symantec said in an alert Monday.
Cyber criminals are sending text messages to iPhone users in the U.S. that appear to be from Apple, but are in fact an attempt at stealing victims’ personal credentials.
“Phishing actors continue to target Apple IDs due to their widespread use, which offers access to a vast pool of potential victims,” Symantec said. “These credentials are highly valued, providing control over devices, access to personal and financial information, and potential revenue through unauthorized purchases.”
Consumers are also more likely to trust communications that appear to come from a trusted brand like Apple, warned Symantec, which is owned by Broadcom, a maker of semiconductors and infrastructure software.
The malicious SMS messages appear to come from Apple and encourage recipients to click a link and sign in to their iCloud accounts. For example, a phishing text could say: “Apple important request iCloud: Visit signin[.]authen-connexion[.]info/icloud to continue using your services.” Recipients are also asked to complete a CAPTCHA challenge in order to appear legitimate, before they’re directed to a fake iCloud login page.
Such cyberattacks are commonly referred to as “smishing” schemes in which criminals use fake text messages from purportedly reputable organizations, rather than email, to lure people into sharing personal information, such as account passwords and credit card data.
How to protect yourself
Be cautious about opening any text messages that appear to be sent from Apple. Always check the source of the message — if it’s from a random phone number, the iPhone maker is almost certainly not likely not to be the sender. iPhone users should also avoid clicking on links inviting people to access their iCloud account; instead, go to login pages directly.
Apple urges users to always enable two-factor authentication for Apple ID for extra security and to make it harder to access to your account from another device. It is “designed to make sure that you’re the only person who can access your account,” Apple said.
The Federal Trade Commission also recommends setting up your computer and mobile phone so that security software is updated automatically.
