Warning to all 1.8b iPhone users over new scam emptying bank accounts

"The phishing email was actually an iCloud Calendar invite, with the scam text hidden in the Notes field and sent to a Microsoft 365 address controlled by the attacker. When an event like this is created, Apple automatically sends an email from its own servers ([e-mail] ) using the calendar owner's name. In this case, the invite went to a Microsoft 365 account believed to be a mailing list, which then forwarded the message to multiple recipients, similar to an earlier PayPal-based phishing campaign."

"Hackers are creating fake emails disguised as purchase notifications coming directly from the tech giant, according to a report from Bleeping Computer. The warning was prompted after a user shared a suspicious email that contained a fraudulent PayPal payment and a message to call if they wanted to discuss the charges. 'Hello Customer, Your PayPal account has been billed $599.00. We're confirming receipt of your recent payment,' stated the email from '[e-mail].'"

"The attackers wanted victims to call back, where they would be told their accounts had been hacked. From there, scammers aimed to trick them into installing malicious software, giving criminals access to steal logins or drain bank accounts. The attack is known as a phishing scam, a cyberattack where criminals send deceptive communications. This is done through emails, texts or calls to impersonate legitimate organizations or people to steal sensitive information such as passwords, bank details or personal data, or to install malware on a victim's device."

Hackers craft fraudulent purchase notifications that appear to come from Apple's noreply email by embedding scam text in iCloud Calendar invites. The scam hides fake payment details in the Calendar Notes field and targets addresses such as Microsoft 365 accounts or mailing lists that then forward the automatic Apple-created emails to many recipients. Recipients receive convincing messages, for example a $599 PayPal charge, urging them to call attackers posing as support. Callbacks lead to claims of hacked accounts and attempts to install malicious software to steal logins or drain bank accounts. Messages sent from Apple servers can bypass security checks.

Read at Mail Online