A new twist on an old phish: Apple scams now using encryption

Persistent phishing scams targeted at Apple users continue to plague inboxes – but what's happening behind the scenes? Trend Micro recently deconstructed a new phishing scam that targets Apple IDs and uses AES encryption as part of its processes.

One of the latest Apple phishing scams, spotted on April 30, uses social engineering to trick users into thinking their Apple account is suspended.

The phishing attacks are also occurring at a time when many genuine businesses are sending emails that ask users to update their details or strengthen security, as part of GDPR requirements.

"It comes as no surprise that malicious actors are trying to take advantage of this email wave by sending phishing pages to users. These actors are getting quite good at impersonating major companies, and they usually try to masquerade as legitimate 'user policy update' emails," Trend Micro says.

The firm says Apple IDs and passwords are valuable to cybercriminals because they can provide access to all applications linked to that Apple account.

This particular scam looked like a genuine email from Apple, however it was flagged for numerous reasons. It was sent to a recipient who did not use Apple products; it asked the person to update their payment details due to 'suspicious activity', and the 'Update Your Payment Details' link did not point to the official Apple domain name.

Instead, the link pointed to a website that generated a new token for each victim.

"The token was valid for at least 48 hours. It seemed to be for tracking the user and was not affected by various user-agents of the different browsers and devices. If clicked, the button opened to a fake Apple website stylised to look legitimate—the fake site even had the same background image as the legitimate Apple site. But the URL was obviously not Apple," Trend Micro says.

What made this phishing attempt different than others is that the phishing site was encrypted using AES.

"Using AES for this kind of obfuscation is unusual for a phishing scam because usually these malicious actors are more concerned with operations rather than security or evasion," Trend Micro says.

When the security firm logged in using a fake Apple ID, it was directed to a malicious website designed to collect data including names, dates of birth, phone numbers, addresses, and credit card details.

After the site had collected all information, it told victims they would be logged out for security reasons. They were then forwarded to the genuine Apple website.

In this case the cybercriminals put effort into securing the information they collected, and even the web directory permissions were correctly set so security researchers weren't able to access the stolen data.

"Users should be wary of links sent by email to access pages like Apple ID login, Google login page, PayPal, social networks and other sensitive sites. There might be other malicious links or file attachments as well, so scanning attachment files with security solutions is a must. Also, users should try to verify the urgency of the information found in suspicious emails from other sources, like the social media pages of the particular organisation," Trend Micro concludes.