Apple’s Hide My Email privacy feature currently faces a significant flaw that may expose users’ real email addresses, compromising one of iCloud+’s core anonymity protections.
According to 404 Media and independent tests, this issue has reportedly remained unaddressed for over a year since it was reported to Apple.
Hide My Email generates disposable email aliases that forward messages to a user’s primary inbox, allowing individuals to sign up for services without revealing their actual email addresses.
However, the reported vulnerability appears to undermine this function by allowing attackers to uncover the true email address associated with the alias. This could expose users to phishing, spam, tracking, and account hijacking.
Tyler Murphy, co-founder of EasyOptOuts, indicated that the flaw can be reproduced, stating, “In our limited tests with volunteers, 100% of Hide My Email addresses were exploitable.”
404 Media also confirmed the problem through its own hidden addresses but chose not to disclose technical details to prevent the bug from being easily exploited.
The scope of the issue is particularly alarming since the feature is marketed as a privacy safeguard rather than a niche add-on. If an attacker can trace a disposable alias back to a person’s real inbox, they might be able to deanonymize users across various services, compile targeted phishing lists, or link separate online identities.
Apple was reportedly notified of this vulnerability in 2025, but as of the reporting date, no fix had been provided. This delay has raised concerns, particularly because the flaw remains exploitable, and researchers warn that disclosing the exact method could accelerate abuse if it becomes public knowledge.
For now, users should treat Hide My Email as not being a complete anonymity layer until Apple releases a patch. Security-conscious individuals are advised to avoid using the feature for high-risk accounts, remain vigilant for suspicious email patterns, and consider whether their aliases are linked to sensitive registrations that could be problematic if deanonymized.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…