Recent ‘MFA Bombing’ Attacks Targeting Apple Users
Summary: Apple customers reported elaborate phishing attacks in which their devices were forced to display dozens of system-level password reset prompts until they responded, followed by calls spoofing Apple Support's real number, 1-800-275-2273. Parth Patel documented on March 23 that after declining 100-plus notifications, a caller gave accurate details about him but the wrong name, which he had only seen on PeopleDataLabs, and researcher Kishan Bagaria suspects a bypass of Apple's rate limiting on reset requests.
Key Takeaway: The attackers' credibility came from people-search data, not Apple: the fake rep read Patel's details back accurately and only failed on a name pulled from a PeopleDataLabs alias, so the breach surface includes what data brokers sell about you. KrebsOnSecurity's testing also found that enabling an Apple Recovery Key does nothing to stop the reset prompts.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026