Phone-Based Phishing Scam Reveals the Growing Sophistication of Attacks Against Apple Users

A new phone-based phishing scam reveals how fraudsters are devising more sophisticated schemes to prey on Apple device users.

According to KrebsOnSecurity, the phishing scam began for Global Cyber Risk LLC CEO Jody Westby when she received an automated call that displayed Apple’s logo, physical address, company domain and customer support phone number. The call warned Westby that unknown attackers had compromised multiple servers containing users’ Apple IDs. It then urged her to ring a 1-866 number immediately.

Suspicious of the call, Westby contacted Apple’s support number directly and requested a callback from a support representative. The agent who called back reassured Westby that Apple had not placed the original call. But when she looked at her phone, Westby observed that her iPhone had lumped together both the scam call and the official callback under Apple’s contact profile on her device. Not surprisingly, this failure of Apple’s own devices to spot a spoof call could potentially fool many users.

The Prevalence of Phishing Attacks Targeting Apple Users

This phony call scam stands out for its extensive use of Apple branding. But by no means is it the only phone-related phishing scam targeting Apple users in recent history. For example, in July 2018, Ars Technica identified an India-based tech support scam using a fake Apple website that popped up a system dialog box with a prompt to call the fraudsters.

These phishing instances come after enterprise mobile security and data management provider Wandera found in 2017 that nearly two-thirds of mobile phishing attacks occur on iOS devices. This rate means that Apple users are twice as likely to experience phishing on their devices than Android users.

Help Your Employees Defend Against Phishing Scams

Security professionals can help employees defend against phishing scams by creating a security awareness training program that uses clear, concise policies based around business requirements. Organizations should also take a layered approach to email security — requiring a mix of both technology and education — to better defend against email-borne phishing campaigns.

David Bisson

Contributing Editor

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

The Prevalence of Phishing Attacks Targeting Apple Users

Help Your Employees Defend Against Phishing Scams

More from

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

New proposed federal data privacy law suggests big changes

Topic updates