A new phishing attack that threatens Apple users has recently emerged: the Apple password reset scam. This attack uses a “multi-factor authentication (MFA) bombardment” method, exploiting Apple’s password reset feature to lure users into a trap.
Here’s what we know…
Apple data leak: All we know about the Apple password reset scam
Here’s how the attack works: Attackers send tens or even hundreds of notifications to the target user, indicating they are taking advantage of Apple’s password reset feature. These notifications ask the user to reset their Apple ID password. Once the user clicks “Allow,” the scammers can compromise their credentials and gain access to their Apple ID.
Even more worryingly, users who choose “Don’t Allow” are unsafe. The attackers then start calling users, this time claiming to be from Apple Support. They aim to send a password reset code to the user’s device and get them to give it to them. Once they have it, the scammers can reset the Apple ID password and gain full access to the user’s account.
So what should you do to protect yourself from this attack?
- Do not click on any options in incoming notifications
- Do not answer calls from unknown numbers, even if it looks like a call from Apple. When Apple calls you, it usually shows “Apple” under the number, even if you haven’t saved it in your contacts
- As a former Apple employee, I must point out that Apple will never call you unless you have an ongoing file with customer service
- Create a 28-character recovery key to change your Apple ID password
- Use strong and unpredictable passwords
- Always enable two-factor authentication
- Check emails and notifications from Apple carefully
- Do not click on any link that looks suspicious
- Do not download apps from any third-party source other than the App Store
This new phishing attack shows once again how important cybersecurity is. Users need to know how to recognize phishing attacks and protect themselves. Apple must address this issue immediately and improve its user protection.
Featured image credit: redgreystock / Unsplash
