iMessage Phishing Scam Uncovered: Apple Users’ Shocking Vulnerability Revealed!

Phishing Texts Trick Apple iMessage Users into Disabling Protection

Cybercriminals are exploiting a trick to turn off Apple iMessage’s built-in phishing protection for a text and trick users into re-enabling disabled phishing links.

With so much of our daily activities done from our mobile devices, whether paying bills, shopping, or communicating with friends and colleagues, threat actors increasingly conduct smishing (SMS phishing) attacks against mobile numbers.

To protect users from such attacks, Apple iMessage automatically disables links in messages received from unknown senders, whether that be an email address or phone number.

However, Apple told Morningpicker that if a user replies to that message or adds the sender to their contact list, the links will be enabled.

Tricking users into replying to the message is a clever tactic used by threat actors, as it exploits user familiarity with responses like “Y” or “STOP” to confirm appointments or opt out of text messages.

Over the past couple of months, Morningpicker has seen a surge in smishing attacks that attempt to trick users into replying to a text so that links are enabled again.

As you can see below, a fake USPS shipping issue and a fake unpaid road toll text were sent from unknown senders, and iMessage automatically disabled the links.

SMS phishing attacks with disabled links

The Phishing Tactic

How Smishing Attacks Work

Smishing attacks are a type of phishing attack that uses SMS or text messages to trick users into revealing sensitive information or performing certain actions.

These attacks often appear to come from trusted sources, such as banks, government agencies, or other organizations, and may contain links or attachments that appear legitimate.

However, these links or attachments may actually be malicious and may install malware on the user’s device or steal sensitive information.

Apple iMessage’s built-in phishing protection works by automatically disabling links in messages received from unknown senders.

This protection is designed to prevent users from falling victim to smishing attacks, but it can also be bypassed if a user replies to the message or adds the sender to their contact list.

The Role of Unknown Senders

Unknown senders play a crucial role in triggering Apple iMessage’s built-in phishing protection.

When a message is received from an unknown sender, iMessage automatically disables the links in the message.

This is designed to prevent users from falling victim to smishing attacks, but it can also be used by threat actors to trick users into replying to the message and enabling the links.

The Tricky Response

Why Replying to the Message Can Enable Phishing Links

Replying to the message can enable phishing links because it tells the threat actor that the user is a potential target.

Once the user has replied to the message, the threat actor can use this information to send additional messages or launch further attacks.

The use of familiar responses like “Y” to trick users is a clever tactic used by threat actors.

Users are often accustomed to typing “Y” or “STOP” to confirm appointments or opt out of text messages, and threat actors exploit this familiarity to trick users into replying to the message.

The consequences of enabling phishing links can be severe, including the installation of malware, the theft of sensitive information, or other forms of cybercrime.

The Growing Threat

Recent Surge in Smishing Attacks Targeting Apple iMessage Users

Over the past couple of months, Morningpicker has seen a surge in smishing attacks that attempt to trick users into replying to a text so that links are enabled again.

These attacks often appear to come from trusted sources, such as banks, government agencies, or other organizations, and may contain links or attachments that appear legitimate.

The FBI has warned of a massive ongoing wave of SMS phishing attacks targeting Americans with lures regarding unpaid road toll fees.

These attacks started last month, and the federal law enforcement agency says thousands of people have already reported that the scammers have targeted them.

Examples of Phishing Lures and Their Language

Phishing lures and their language can vary widely, but they often contain certain keywords or phrases that are designed to trick users into falling victim to the attack.

In the case of the recent surge in smishing attacks, the phishing lures often contain language related to unpaid road toll fees or other financial issues.

For example, a recent phishing attack sent to users in Pennsylvania claimed that the user owed money for an outstanding toll and contained a link to pay the debt.

The link provided within the text was created to impersonate the state’s toll service name, and phone numbers appeared to change between states.

The FBI has warned that these phishing attacks are becoming increasingly sophisticated and that users must be vigilant in order to avoid falling victim.

Analysis and Implications

Threat Actor’s Strategy

The threat actor’s strategy is to exploit user familiarity with responses like “Y” or “STOP” to trick users into replying to the message.

Once the user has replied to the message, the threat actor can use this information to send additional messages or launch further attacks.

The use of fake messages from trusted sources like USPS or toll services is also a key part of the threat actor’s strategy.

The goal of smishing attacks is to collect personal information or financial data, which can be used for a variety of malicious purposes.

The Vulnerable Target

Older adults or less tech-savvy individuals are often the prime targets of smishing attacks.

These individuals may be less familiar with the tactics used by threat actors and may be more likely to fall victim to the attack.

The consequences of not taking action against smishing attacks can be severe, including the installation of malware, the theft of sensitive information, or other forms of cybercrime.

Practical Aspects and Prevention

Recognizing Smishing Attacks

Warning signs of a smishing attack include unknown senders or disabled links.

Users should be cautious of messages that contain links or attachments from unknown senders and should not click on these links or attachments.

Users should also be aware of the language and tone used in the message, as phishing attacks often contain language that is designed to trick users into falling victim.

Protecting Your Account

Enabling two-factor authentication (2FA) on Apple devices can help to prevent smishing attacks.

Users should also use secure passwords and passcodes to protect their accounts and should keep their software and apps up to date.

By taking these steps, users can help to prevent smishing attacks and protect their sensitive information.

Reporting Smishing Attacks

How to Report Smishing Attacks

Users who receive a smishing attack should report it to the FBI or local authorities.

Users can also share information with others to prevent further attacks.

By working together, users can help to prevent smishing attacks and protect their sensitive information.