Human weaknesses are a rich target for phishing attacks. Making humans click "Don't Allow" over and over again in a phone prompt that can't be skipped is an angle some iCloud attackers are taking—and likely having some success.
Brian Krebs' at Krebs on Security detailed the attacks in a recent post, noting that "MFA Fatigue Attacks" are a known attack strategy. By repeatedly hitting a potential victim's device with multifactor authentication requests, the attack fills a device's screen with prompts that typically have yes/no options, often very close together. Apple's devices are just the latest rich target for this technique.
Both the Kremlin-backed Fancy Bear advanced persistent threat group and a rag-tag bunch of teenagers known as Lapsus$ have been known to use the technique, also known as MFA prompt bombing, successfully.
If the device owner is annoyed by the sudden sound or deluge of notifications (which essentially block access to other phone features) or just considers the prompt too quickly and has trained themselves to click "Yes"/"Allow" to most other prompts, they may click "Allow" and give the attackers the access they need. Or, having to dismiss so many prompts, their thumb or finger might simply hit the wrong pixel and accidentally let the bad folks in.
Parth Patel, an AI startup founder, detailed a March 22 attack on himself in a thread on X (formerly Twitter). Parth said that his Apple phone, watch, and laptop all received "100+ notifications" asking to use those devices to reset his Apple password. Given the nature of the prompt, they can't be ignored or dismissed until acted upon, all but locking up the devices.
Having dismissed the alerts, Parth then received a call that was spoofed to appear as if it were coming from Apple's official support line. Parth asked them to validate information about him, and the callers had his date of birth, email, current address, and former addresses available. But Parth, having previously queried himself on people search sites, caught the caller using one of the names frequently tied into his reports. The caller also asked for an Apple ID code sent by SMS, the kind that explicitly follows up with "Don't share it with anyone."
Loading comments...
