Monday, March 4, 2024

Beware!! Hackers Using New Tools to Break open Apple iCloud Accounts to Unlock Stolen iPhone’s

A New Phishing and scam tools are discovered that used by the cyber criminal to unlock the physically stolen iPhones by compromising the victim’s iCloud accounts through abusing the “find my iPhone” future.

Once iPhone user linked to an Apple ID with iCloud Account then the Device owner can lock the Phone if it gets lost or stolen using Apple’s Find My iPhone settings.

Last Year U.S alone more than 23,000 iPhones stolen case was reported that cost around $6.7 million and a large amount of physically stolen iPhone’s are shipped from Ireland and the U.K. to India, Argentina, and the U.S.

Hacking tools such as MagicApp, Applekit, and Find My iPhone (FMI.php) framework are mainly used by Apple iCloud phishers and used these tools to automatically unlock the iCloud accounts and later Resell it to a black market.

Also Read: Phishing and Keylogging Major Threats to Google Accounts Security

How Does Attackers Unlock Stolen iPhone’s 

The attacker is using a sophisticated phishing attack to unlock the phone via compromising the iCloud account to the victim who lost their iPhone by physical theft.

Initially, After activating find my iPhone future, soon after victim receives an SMS or Email which has some spoofed Information that comes from Apple that completely looks like a legitimate information.

Eger Victims will always click the Phishing Link that redirected to a webpage that looks like legitimate one that will ask an Apple ID or iCloud Account Credentials from Victims.

Attack chain

Once Victims Provide an information about iCloud or Apple ID, Attacker could gain the credential information and unlock their iPhone and delete the account which is linked to it.Now the iPhone will be unlocked and later it can sell it or reuse it.

Trend Micro discovered a GitHub Repository where some source code of one of the phishing pages and different tools for building iCloud phishing pages.
The phishing page is based on what cybercriminals call FMI.php (Find My iPhone framework) / Devjo class, a component present in many other phishing kits. It’s the closest tool cybercriminals have that resembles Apple’s Find My iPhone Application Program Interface (API).

A fake Apple verifier phishing script project on Github

Once users give away their Credential information to a phishing page, FMI.php framework used to retrieve the information such as the cell phone number, passcode length, ID, GPS location, whether the device is locked or not from iCloud.

This Framework aslo capable of automatically deletes the victim’s Apple account after it’s unlocked.

    Sample email received by Attacker with the victim’s Apple ID and password

Also, These Toolkits are actively advertising and selling via online as well as a black market with full tutorials of user Manual that guide you to how to use the kit to Unlock Stolen iPhone’s.

Some of iPhone unlocker Kits

AppleKit: iCloud Fraud as a Service
MagicApp: Automating iCloud Fraud
iUnlocker: MagicApp Affiliate

Tool Kit Futures

  • Email notifications to the attacker, which include the victim’s IP, HTTP referral, browser User-Agent, etc.
  • Access to the victim’s iCloud, enabling them to get device information, unlock it, or delete the device from the account
  • Anti-crawler and AV scanner capabilities, which are blocked by IP ranges

Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles