Several iPhone users have reported a new scam attempt to steal their Apple ID passwords in recent days. The case was determined as follows: Krebs on Security and users who detect fraud. This is the case of businessman Parth Patel, who described the entire process on social network X.
Crime starts like this multiple password reset requests for the same account. Multiple notifications indicate that someone is persistently trying to guess or access your Apple ID password.
This is the first step that can result in cybercrime. Users who accidentally confirm a password change or log in using two-factor authentication (2FA) end up granting access to attackers.
Attackers conducted a high-effort attack on me using People Data Labs’ OSINT data and caller ID spoofing.
First, around 6:36 last night, all of my Apple devices started blowing up with Reset Password notifications.
Because these are Apple system level warnings,… pic.twitter.com/vX1AZvoVoN
— Parth (@parth220_) March 23, 2024
Since users will not be able to use the device until they resolve the password reset notifications, The idea is to overpower the victim through exhaustion.. But even if the user rejects all requests at this stage, cybercriminals do not give up and this is where the fraud becomes even more complex.
A dangerous and complex scam
About fifteen minutes after parsing the flood of password reset requests, Patel says: I received a call from a number that looked official. Apple for technical support to the consumer. There was even a person claiming to be from the company.
The suspicious businessman asked the person on the other end of the line to verify his personal information. Surprisingly, Almost all the information was correct except for an error in the full name. When Patel saw the same flaw in databases leaked or illegally published online, he realized he was still in the middle of the scam.
The link idea was this: provide security to the user and enable them to release the password reset. When he hung up and called actual Apple support, he was told no employees had contacted him that day.
HE Krebs on Security brings other reports similar to how the scam works. In any case, it is possible that cybercriminals are using a database that contains other registration data as well as the phone number. Here’s the advice: Always decline password reset requests and change your access code if possible.
Source: Tec Mundo
I’m Ben Stock, a highly experienced and passionate journalist with a career in the news industry spanning more than 10 years. I specialize in writing content for websites, including researching and interviewing sources to produce engaging articles. My current role is as an author at Gadget Onus, where I mainly cover the mobile section.
