Tuesday, July 23, 2024

Beware!! Hackers Using New Tools to Break open Apple iCloud Accounts to Unlock Stolen iPhone’s

A New Phishing and scam tools are discovered that used by the cyber criminal to unlock the physically stolen iPhones by compromising the victim’s iCloud accounts through abusing the “find my iPhone” future.

Once iPhone user linked to an Apple ID with iCloud Account then the Device owner can lock the Phone if it gets lost or stolen using Apple’s Find My iPhone settings.

Last Year U.S alone more than 23,000 iPhones stolen case was reported that cost around $6.7 million and a large amount of physically stolen iPhone’s are shipped from Ireland and the U.K. to India, Argentina, and the U.S.

Hacking tools such as MagicApp, Applekit, and Find My iPhone (FMI.php) framework are mainly used by Apple iCloud phishers and used these tools to automatically unlock the iCloud accounts and later Resell it to a black market.

Also Read: Phishing and Keylogging Major Threats to Google Accounts Security

How Does Attackers Unlock Stolen iPhone’s 

The attacker is using a sophisticated phishing attack to unlock the phone via compromising the iCloud account to the victim who lost their iPhone by physical theft.

Initially, After activating find my iPhone future, soon after victim receives an SMS or Email which has some spoofed Information that comes from Apple that completely looks like a legitimate information.

Eger Victims will always click the Phishing Link that redirected to a webpage that looks like legitimate one that will ask an Apple ID or iCloud Account Credentials from Victims.

Attack chain

Once Victims Provide an information about iCloud or Apple ID, Attacker could gain the credential information and unlock their iPhone and delete the account which is linked to it.Now the iPhone will be unlocked and later it can sell it or reuse it.

Trend Micro discovered a GitHub Repository where some source code of one of the phishing pages and different tools for building iCloud phishing pages.
The phishing page is based on what cybercriminals call FMI.php (Find My iPhone framework) / Devjo class, a component present in many other phishing kits. It’s the closest tool cybercriminals have that resembles Apple’s Find My iPhone Application Program Interface (API).

A fake Apple verifier phishing script project on Github

Once users give away their Credential information to a phishing page, FMI.php framework used to retrieve the information such as the cell phone number, passcode length, ID, GPS location, whether the device is locked or not from iCloud.

This Framework aslo capable of automatically deletes the victim’s Apple account after it’s unlocked.

    Sample email received by Attacker with the victim’s Apple ID and password

Also, These Toolkits are actively advertising and selling via online as well as a black market with full tutorials of user Manual that guide you to how to use the kit to Unlock Stolen iPhone’s.

Some of iPhone unlocker Kits

AppleKit: iCloud Fraud as a Service
MagicApp: Automating iCloud Fraud
iUnlocker: MagicApp Affiliate

Tool Kit Futures

  • Email notifications to the attacker, which include the victim’s IP, HTTP referral, browser User-Agent, etc.
  • Access to the victim’s iCloud, enabling them to get device information, unlock it, or delete the device from the account
  • Anti-crawler and AV scanner capabilities, which are blocked by IP ranges

Latest articles

Beware Of Dating Apps Exposing Your Personal And Location Details To Cyber Criminals

Threat actors often attack dating apps to steal personal data, including sensitive data and...

Hackers Abusing Google Cloud For Phishing

Threat actors often attack cloud services for several illicit purposes. Google Cloud is targeted...

Two Russian Nationals Charged for Cyber Attacks against U.S. Critical Infrastructure

The United States has designated Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, two members...

Threat Actors Taking Advantage of CrowdStrike BSOD Bug to Deliver Malware

Threat actors have been found exploiting a recently discovered bug in CrowdStrike's software that...

NCA Shut’s Down the Most Popular “digitalstress” DDoS-for-hire Service

The National Crime Agency (NCA) has successfully infiltrated and dismantled one of the most...

Play Ransomware’s Linux Variant Attacking VMware ESXi Servers

A new Linux variant of Play ransomware targets VMware ESXi environments, which encrypts virtual...

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles