Blog

Apple has released new guidelines for all iPhone users to protect themselves following a cyberattack that targeted more than a billion devices last week.

The company warned users that hackers are using social engineering tactics, such as pretending to be company representatives, to gain access to personal data such as login credentials, security codes and financial information.

Watch out for phishing emails that trick users into sharing information or handing over money, as well as fraudulent pop-up ads, fake promotions, unwanted calendar invites, and fake calls.

As a first step, if they haven’t already enabled it, iPhone owners should set up two-factor authentication, which requires a password and a six-digit verification code to access their account from an external device.

Apple is urging users to beware of receiving fraudulent calls from what appears to be a legitimate phone number, but is actually a bad actor trying to steal your information.

They may try to build a relationship to gain your trust and will mention personal information about your account such as your home address, place of work, or even a social security number.

This scammer will likely claim that there is a problem with the account and that someone has made unauthorized charges using Apple Pay and make it appear urgent so that the user feels compelled to resolve the situation immediately.

Click here to resize this module

“Spoofing calls usually work to create a strong sense of urgency to give you no time to think and dissuade you from contacting Apple directly yourself,” Apple warned.

“For example, the scammer may say you are free to call Apple back, but the fraudulent activities will continue and you will be held responsible. This is false and is intended to prevent you from closing.

Apple noted on its support page that fraudsters may also ask iPhone users to disable features such as two-factor authentication or stolen device protection.

“They will claim that this is necessary to help stop an attack or to allow you to regain control of your account,” the tech giant said.

“However, they are trying to trick you into lowering your security so they can launch their own attack.”

The company said there are ways to identify fraudulent emails and messages to avoid being tricked into revealing your personal information.

First, users should look at the sender’s email or phone number to see if it matches the company name and if the email address they used to contact you is different from the one on your account.

Other methods include checking whether the URL link they sent matches Apple’s website, whether the message looks different from others you’ve received from the company, and whether it requires personal information such as an account password or credit card number.

If a user receives a suspicious call, they should immediately hang up and call Apple directly to confirm the notification they received, or they can report fraudulent phone calls to the US Federal Trade Commission or local law enforcement.

Apple’s warning comes just a week after fraudsters used SMS phishing campaigns that sent iPhone users fake messages telling them to visit a link to an “important request” for iCloud.

California-based security firm Symantec discovered the attack this month, warning that links led to fake websites that urged users to hand over their Apple ID information.

The company posted the alert on July 2, noting that it had spotted a hovering malicious SMS that read: “Important Apple iCloud request: Visit login[.]authentic connection[.]info/icloud to continue using your services.’

Symantec said the hackers added a CAPTCHA to the fake website to make it appear legitimate, and once completed, it would lead users to an outdated iCloud login template.

“Phishing actors continue to target Apple IDs due to their widespread use, which offers access to a vast array of potential victims,” ​​Symantec said in a warning last week.

“These credentials are highly valued, providing control over devices, access to personal and financial information, and potential revenue through unauthorized purchases.”

Apple has clarified that its support representatives will never send users to a website link to sign in or ask them to provide their device password or two-factor authentication code.

“If someone claiming to be from Apple asks you for any of the above, they are a fraudster engaging in a social engineering attack. Hang up or otherwise end contact with them,” Apple said.