While Apple’s privacy and security systems are usually well-protected against attacks, it isn’t completely safe from occasional phishing schemes. Over the years, we’ve seen many phishing attacks targeting Apple users.
Now, Apple users are being hit by an MFA bombing attack, exploiting a system glitch. Parth Patel witnessed multiple Reset Password prompts on their Apple devices and took to Twitter/X to share the details.
The scammers bombard victims with system-level prompts on their Apple devices that require action to make the notification go away. Then, they escalate the scheme by phoning victims and posing as Apple Support.
Patel told KrebsOnSecurity: “All of my devices started blowing up, my watch, laptop, and phone. It was like this system notification from Apple to approve [a reset of the account password], but I couldn’t do anything else with my phone. I had to go through and decline like 100-plus notifications. “
Scammers gave precise personal information, except the victim’s true name. In this instance, the scammer used a people-search website called PeopleDataLabs to get the information with the incorrect Patel’s first name.
Chris, a Bitcoin hedge fund owner, also witnessed an MFA bombing attacker where he got a call from fake Apple support and multiple password reset alerts. He even bought a new iPhone and changed his passwords, but the alerts continued, indicating an attacker was using his phone number linked to the Apple account.
Even after following Apple’s advice to take precautions, such as turning on a recovery key, Chris still received alerts.
Another user, Ken, also reported unsolicited system password reset messages on his Apple devices but didn’t receive any call from fake Apple Support.
We recommend you not to share the six-digit 2-factor code with anyone, not even Apple. Companies and banks never request you to share two-factor codes.