Apple device owners are currently facing a sophisticated phishing scheme, dubbed “multi-factor authentication (MFA) bombing,” aimed at compromising their data. This scam involves overwhelming users with repeated password reset notifications through Apple’s password reset tool. If a user accidentally presses “Allow,” the scammers move closer to gaining control over the Apple ID account.
The attackers don’t stop with just notifications. They follow up with phone calls pretending to be Apple support, asking for the password reset code sent to the user’s device. This would give them everything they need to reset the password and access the account.
This type of phishing attack, while utilizing Apple’s systems, is part of a broader trend of increased phishing activities, especially on mobile devices. In 2022 alone, mobile phishing attacks jumped by 61%, showing how prevalent and dangerous these tactics have become.
Despite efforts to counter the attack, such as creating a recovery key, there seems to be no simple solution to fully prevent the onslaught of reset notifications. This suggests that the design of Apple’s password reset feature may unintentionally facilitate these attacks.
What to Do If Targeted:
- Always select “Don’t Allow” if you receive unsolicited password reset notifications.
- Do not respond to any follow-up calls claiming to be from Apple support asking for any codes or password information.
- Stay informed and cautious of unsolicited attempts to change your account details.
Until Apple addresses this vulnerability, the best defense for users is to remain aware and cautious, especially when dealing with unexpected requests to change account passwords or other security settings.
