Cyberattack Targets Apple Users in Smishing Campaign

A new cyberattack is targeting iPhone users, with criminals trying to obtain individuals' Apple IDs in a "phishing" campaign, security software company Symantec said in an alert on Monday.

Cybercriminals are sending text messages to iPhone users in the United States that appear to be from Apple company, but it is an attempt to steal victims' personal credentials.

“Phishing actors continue to target Apple IDs due to their widespread use, providing access to a wide range of potential victims,” Symantec said. “These credentials are highly valuable, providing control of devices, access to personal and financial information, and potential revenue through unauthorized purchases.”

The alert suggests consumers will trust communications that appear to come from a trusted brand like Apple, Symantec warned.

The malicious SMS appears to come from Apple and encourages recipients to click a link and sign in to their iCloud accounts. A phishing text could say: “Important request from Apple iCloud: Visit Sign in at a given link to continue using your services.” Recipients are also asked to complete a CAPTCHA to appear legitimate, before being directed to a fake iCloud login page.

Such cyberattacks are commonly referred to as “Smishing” schemes in which criminals use fake text messages from allegedly reputable organizations, rather than email, to lure people into sharing personal information, such as passwords. Account and credit card information.

Apple urges users to always enable multi-factor authentication for their Apple ID for added security and to make it more difficult to access your account from another device. Apple said it's "designed to make sure you're the only person with access to your account."

Apple adds that its support representatives will never send its users a link to a website and ask them to log in or provide a password, device passcode, or two-factor authentication code.

The company said: “If someone claiming to be from Apple asks you to do any of the above, they are a scammer participating in a social engineering attack. Hang up or end contact with them in any other way.”