Thursday, March 28, 2024

Beware!! Hackers Using New Tools to Break open Apple iCloud Accounts to Unlock Stolen iPhone’s

A New Phishing and scam tools are discovered that used by the cyber criminal to unlock the physically stolen iPhones by compromising the victim’s iCloud accounts through abusing the “find my iPhone” future.

Once iPhone user linked to an Apple ID with iCloud Account then the Device owner can lock the Phone if it gets lost or stolen using Apple’s Find My iPhone settings.

Last Year U.S alone more than 23,000 iPhones stolen case was reported that cost around $6.7 million and a large amount of physically stolen iPhone’s are shipped from Ireland and the U.K. to India, Argentina, and the U.S.

Hacking tools such as MagicApp, Applekit, and Find My iPhone (FMI.php) framework are mainly used by Apple iCloud phishers and used these tools to automatically unlock the iCloud accounts and later Resell it to a black market.

Also Read: Phishing and Keylogging Major Threats to Google Accounts Security

How Does Attackers Unlock Stolen iPhone’s 

The attacker is using a sophisticated phishing attack to unlock the phone via compromising the iCloud account to the victim who lost their iPhone by physical theft.

Initially, After activating find my iPhone future, soon after victim receives an SMS or Email which has some spoofed Information that comes from Apple that completely looks like a legitimate information.

Eger Victims will always click the Phishing Link that redirected to a webpage that looks like legitimate one that will ask an Apple ID or iCloud Account Credentials from Victims.

Attack chain

Once Victims Provide an information about iCloud or Apple ID, Attacker could gain the credential information and unlock their iPhone and delete the account which is linked to it.Now the iPhone will be unlocked and later it can sell it or reuse it.

Trend Micro discovered a GitHub Repository where some source code of one of the phishing pages and different tools for building iCloud phishing pages.
The phishing page is based on what cybercriminals call FMI.php (Find My iPhone framework) / Devjo class, a component present in many other phishing kits. It’s the closest tool cybercriminals have that resembles Apple’s Find My iPhone Application Program Interface (API).

A fake Apple verifier phishing script project on Github

Once users give away their Credential information to a phishing page, FMI.php framework used to retrieve the information such as the cell phone number, passcode length, ID, GPS location, whether the device is locked or not from iCloud.

This Framework aslo capable of automatically deletes the victim’s Apple account after it’s unlocked.

    Sample email received by Attacker with the victim’s Apple ID and password

Also, These Toolkits are actively advertising and selling via online as well as a black market with full tutorials of user Manual that guide you to how to use the kit to Unlock Stolen iPhone’s.

Some of iPhone unlocker Kits

AppleKit: iCloud Fraud as a Service
MagicApp: Automating iCloud Fraud
iUnlocker: MagicApp Affiliate

Tool Kit Futures

  • Email notifications to the attacker, which include the victim’s IP, HTTP referral, browser User-Agent, etc.
  • Access to the victim’s iCloud, enabling them to get device information, unlock it, or delete the device from the account
  • Anti-crawler and AV scanner capabilities, which are blocked by IP ranges
Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles