Phishing for Apples, Bobbing for Links
Summary: KrebsOnSecurity reported on a phishing campaign that texts Apple customers claiming a lost iPhone has been found, linking to spoofed "Find My" domains such as maps-icloud[.]com, hosted on a Russian server alongside more convincing links like apple.com-support[.]id and icloud.com-site-log[.]in. Many of the links carry encryption certificates and use subdomains beginning with "apple." or "icloud." followed by domains starting with "com-", and the phishers forward visitors to the base domains on to Apple's real iCloud login page to appear legitimate.
What you should know: The padlock and an "apple." or "icloud." prefix in the address bar are exactly what users are taught to trust, and here both are present on domains that belong to the attacker. A recipient who checks the base domain instead of clicking through gets redirected to the genuine iCloud login, which confirms the deception rather than exposing it.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026