Story image

A new twist on an old phish: Apple scams now using encryption

15 May 18

Persistent phishing scams targeted at Apple users continue to plague inboxes – but what’s happening behind the scenes? Trend Micro recently deconstructed a new phishing scam that targets Apple IDs and uses AES encryption as part of its processes.

One of the latest Apple phishing scams, spotted on April 30, uses social engineering to trick users into thinking their Apple account is suspended.

The phishing attacks are also occurring at a time when many genuine businesses are sending emails that ask users to update their details or strengthen security, as part of GDPR requirements.

“It comes as no surprise that malicious actors are trying to take advantage of this email wave by sending phishing pages to users. These actors are getting quite good at impersonating major companies, and they usually try to masquerade as legitimate ‘user policy update’ emails,” Trend Micro says.

The firm says Apple IDs and passwords are valuable to cybercriminals because they can provide access to all applications linked to that Apple account.

This particular scam looked like a genuine email from Apple, however it was flagged for numerous reasons. It was sent to a recipient who did not use Apple products; it asked the person to update their payment details due to ‘suspicious activity’, and the ‘Update Your Payment Details’ link did not point to the official Apple domain name.

Instead, the link pointed to a website that generated a new token for each victim.

“The token was valid for at least 48 hours. It seemed to be for tracking the user and was not affected by various user-agents of the different browsers and devices. If clicked, the button opened to a fake Apple website stylised to look legitimate—the fake site even had the same background image as the legitimate Apple site. But the URL was obviously not Apple,” Trend Micro says.

What made this phishing attempt different than others is that the phishing site was encrypted using AES.

“Using AES for this kind of obfuscation is unusual for a phishing scam because usually these malicious actors are more concerned with operations rather than security or evasion,” Trend Micro says.

When the security firm logged in using a fake Apple ID, it was directed to a malicious website designed to collect data including names, dates of birth, phone numbers, addresses, and credit card details.

After the site had collected all information, it told victims they would be logged out for security reasons. They were then forwarded to the genuine Apple website.

In this case the cybercriminals put effort into securing the information they collected, and even the web directory permissions were correctly set so security researchers weren’t able to access the stolen data.

“Users should be wary of links sent by email to access pages like Apple ID login, Google login page, PayPal, social networks and other sensitive sites. There might be other malicious links or file attachments as well, so scanning attachment files with security solutions is a must. Also, users should try to verify the urgency of the information found in suspicious emails from other sources, like the social media pages of the particular organisation,” Trend Micro concludes.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
What disaster recovery will look like in 2019
“With nearly half of all businesses experiencing an unrecoverable data event in the last three years, current backup solutions are no longer fit for purpose."
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.