Apple ID Phishing Scam — WHAT IS IT + How to Remove

This article has been created in order to explain to you what is the Apple ID Phishing Scam and how you can remove them as well as all potentially unwanted programs delivered through them.

The Apple ID Phishing Scam is a popular malware tactic that attempts to manipulate Apple users into infecting themselves with viruses or disclosing their passwords. At the moment we do not have information about the perpetrators behind it. Our article gives an in-depth explanation of how it propagates and how victims can attempt to remove active infections.

Threat Summary

Name Apple ID Phishing Scam
Type Phishing email scam
Short Description The Apple ID Phishing Scam is a recent example of the scam tactic that extorts the targets into interacting with a scam site.
Symptoms Victims will receive email messages that contain the phishing instructions.
Distribution Method Phishing emails.
Detection Tool See If Your System Has Been Affected by malware


Malware Removal Tool

User Experience Join Our Forum to Discuss Apple ID Phishing Scam.

Apple ID Phishing Scam — Update April 2020

In April 2020 phishing attacks using the social engineering strategy of impersonating Apple ID messages continues. An unknown hacking group is behind the attacks. It is spread via email messages which are sent in bulk. Infected computers and web mail servers are sending out notifications that manipulate the recipients into thinking that their accounts have been locked by Apple. The users will be redirected to a hacker-controlled page, in most cases the addresses are configured to be phishing login pages. The main goal of the hackers are to hijack the credentials of the victims.

Apple ID Phishing Scam – Distribution Ways

The Apple ID phishing scam is distributed using various methods. The main one is the creation of sites that share a similar name to Apple and their services. They are distributed using various methods:

  • Social Network Links — By using fake or hacker-made profiles on popular social networks (Facebook, Twitter, Instagram and etc.) the Apple ID phishing scam can be promoted. Usually shortened links are used to link the main pages.
  • Email Messages — Bulk email messages containing links to the Apple ID phishing page can be sent to the users in both personalized and non-personalized forms. The malicious actors can use the same design layout, body contents and elements as real Apple emails.
  • Similar Sounding Names — The Apple ID phishing scam can be distributed on various sites that all have a similar sounding domain name to Apple.

Note that the Apple phishing ID landing page can be displayed by software and files as well. A prime example is the modified software installer — the criminals take the setup files of popular software and add to them the code that shows the phishing page. The other type is the creation of infected documents that can be of any popular type: rich text documents, presentations, databases and spreadsheets. When they are opened a prompt will appear asking the users to enable the built-in scripts. When this is done the links will be opened in a browser window or directly as an embedded object.

In some cases the hackers can also make use of malware browser extensions, alternatively known as hijackers. The criminals make them compatible with the most popular web browsers in order to increase the number of victim users. They are frequently uploaded to the official hacker repositories using fake or stolen user reviews and developer credentials. The uploaded strains feature descriptions that promise the optimization of the browsers or the enhancement with newer features. If the users install them then the typical hijacker behavior will be observed. Direct effects are the manipulations of the web browsers into directly redirecting the users to the Apple ID phishing scam page. This is done by changing the default values — home page, new tabs page and search engine.

Apple ID Phishing Scam – In-Depth Overview

When the Apple ID phishing scam page is displayed to the users the basic view will show a login page that uses the design layout and elements of the real Apple site. The hackers manipulate the users into believing that a site belonging to the company is being accessed. Scams such as this one feature several distinct elements, one of the main ones is the fact that many copies of the page can be created. They can be hosted on servers around the world — not all of them will be served on the same domains. From an administrator point of view this gives the hackers greater flexibility as they can easily deploy thousands of them in a short period of time. To further coerce the users into thinking that they are accessing real Apple pages they can use include security certificates and cross-site linking.

The main goal of the page is to coerce the users into revealing their account credentials to the site. They will be automatically transferred to the malicious operators of the Apple ID phishing scam site as soon as they are entered. However there are other malicious actions that may be executed. All of them are connected to the site interaction in some way or another.

Visiting the sites can lead to the installation of tracking cookies and data collection modules. They will automatically hijack data both from the web browsers and the infected devices. There are two main categories of data that can be distinguished:

  • Anonymous Statistics — The cookies will be able to track how the users interact with various web elements.
  • Private Data — The data collection of information that can directly expose the identity of the victims.

Through the various scripts the machines can be come infected with cryptocurrency miners as well. They represent applications that make use of the available system resources in order to run complex mathematical calculations. When the successful tasks are reported to the relevant servers the hacker operators will receive profit in the form of cryptocurrency. An additional consequence is the delivery of intrusive ads — they can cause redirects to other malware sites or present links to sponsored content. In most cases all popular mechanisms can be used: pop-ups, banners, in-line links and etc.

If any file downloads are offered then practically all types of malicious payloads can be offered. The files themselves will probably be renamed with Apple related services, products and software. Beware that among the most frequently used strings used to rename such payloads include “update” and “manual”. Common infections include the following:

  • Direct Virus Downloads — Virus files across all common types can be delivered: ransomware, Trojans, miners and etc.
  • Documents with Malware Scripts — The Apple ID phishing scam page can also distribute malware via documents. The users will find that various files of all popular types can contain the malicious scripts: rich text documents, spreadsheets, presentations and databases. Whenever they are opened by the victims a prompt will appear asking for the users to enable the built-in macros. If this is done the scripts will download a preset virus from the Internet and launch it on the local computer.
  • Malicious Setup Files — The criminals can also create copycat malicious installers of popular software. The most common way is to take the real file from the official vendor site and add the necessary scripts to them. The reason why this approach is particularly popular is that it targets applications that are often used: creativity suites, system utilities and productivity apps.

In some cases scams like this one can be used to spread Trojan viruses. They represent advanced malware that set up a client service to a hacker-controlled server. The connection is made both secure and constant thus allowing the hackers to overtake control of the machines at any given time. This also includes the retrieval of user data, spying in real-time and deploying other viruses at will. Through it the hackers can also recruit the machines to botnet networks which are particularly useful for organizing distributed attacks against pre-selected targets.

Apple ID Phishing Scam Example — Receipt Order Email

A wave of phishing Apple ID scams are being coordinated against end users using the subject line of “Receipt Order” following by information about a booking order with the company. This tactic attempts to confuse them into thinking that a made payment for Apple’s services has been processed and that information about the transaction is available in the attached payment receipt. The messages will have PDF file attachments which contain virus code in their macros or are direct samples. If the file is launched it will most likely lead to a dangerous infection.

Apple ID Phishing Scam Example — Apple Payment Payment Has Been Complete

Security alerts indicate a new phishing scam making use of malicious web pages and social network messages as the main medium. We have received an email-based sample which is made to look like as it was sent by Apple. The message contents will include elements that may be mistaken for real data:

  • Customer ID
  • Date
  • Receipt Details

The message motions to the targets that a payment through Apple has been made quoting randomly-generated fields such as customer and order ID and the date of completion. This scam is deemed very effective as Apple payments are widely used in some areas and users might not be aware that this is a fraud notification. The email may insert links to various end pages. Some of the possible ones include the following:

  • Fake Login Pages — The victims can be forwarded to fake Apple login pages where the victims are requested to enter in their Apple ID credentials. The pages can be designed to look just like the real ones and the only difference can be the domain name or security certificate. As soon as the information is entered the hacker operators will be able to take over the accounts. This makes it possible to conduct both financial abuse and identity theft.
  • Virus Downloads — The other possible end goal is to deliver a malicious payload via one of the links found in the emails. It can be any of the popular virus types: miners, Trojans, ransomware and etc.
  • Advertisements — The other possible outcome is to direct the targets to a page with intrusive advertisements. For every click a profit of several cents will be made for the operators. Larger campaigns can generate a good source of income for the criminal collective directing such attacks.

An example message reads the following:

Apple Payment Payment Has Been Completelease check your Receipt Customer ID-899782.nice day Thursday, October 11,2018#95647
date today at 2:15 PM
Apple Payment