iOS Device Ransom Attacks Continue to Target Users in U.S. and Europe

A few years ago, a number of users in Australia were victimized by attackers remotely locking iPhones, iPads, and Macs using Find My iPhone on iCloud. Compromised devices typically displayed Russian ransom messages demanding payments of around $50 to $100 for the device to be unlocked.

australian_ios_device_hacked

A ransom message targeting a Mac in 2014 with the common pseudonym "Oleg Pliss"

At the time, IT security expert Troy Hunt noted that the attackers were likely using compromised emails and passwords exposed from various online security breaches to log in to iCloud accounts. AOL and eBay, for example, were among several high-profile companies that suffered data breaches in 2014.

Apple later confirmed that iCloud was not compromised, and that the eventually-arrested attackers had instead gained access to Apple IDs and passwords through external sources. Russian website MKRU said the attackers obtained the credentials via phishing pages and social engineering techniques.

Since then, CSO security blog Salted Hash has discovered that, since at least February of this year, these ransom attacks have returned and now target users in the U.S. and Europe. The methods used by attackers are said to be the same ones used in 2014, starting with a compromised Apple ID.

It starts with a compromised Apple ID. From there, the attacker uses Find My iPhone and places the victim's device into lost mode. At this point, they can lock the device, post a message to the lock screen and trigger a sound to play, drawing attention to it.

In each of the cases reported publicly, the ransom demanded is usually $30 to $50. If a victim contacts the referenced email address, in addition to payment instructions, they're told they have 12 hours to comply or their data will be deleted.

The website shared screenshots and linked to a number of Facebook, Twitter, and Reddit users whose devices appear to have been held for ransom in recent months, but there is speculation that the problem could be much larger than that. The following excerpt is highly questionable, however, and could very likely be incorrect.

Earlier this week, a security professional posted a message to a private email group requesting information related a possible compromise of at least 40 million iCloud accounts.

Salted Hash started digging around on this story after the email came to our attention. In it, a list member questioned the others about a rumor concerning "rumblings of a massive (40 million) data breach at Apple."

The message goes on to state that the alleged breach was conducted by a Russian actor, and vector "seems to be via iCloud to the 'locate device' feature, and is then locking the device and asking for money."

The report adds that "for now, let's assume there hasn't been a massive iCloud data breach." Apple has not commented on the matter.

Given that the Apple ID credentials involved in the ransom attacks are believed to originate from online security breaches, Salted Hash pointed towards a recently compromised Mac-Forums.com database, which allegedly includes 291,214 accounts, being sold for around $775 on the darknet.

There is currently no evidence to suggest that the Mac-Forums database has any relation to these ransom attacks, but users with an account on that website should change their passwords out of an abundance of caution. Setting a device passcode and enabling two-factor authentication for your Apple ID is also highly recommended.

Apple has a support document outlining steps to take if you think your Apple ID has been compromised. Also read security and your Apple ID.

Top Rated Comments

LordQ Avatar
97 months ago
Apple under Tim Cook is slipping...
WTF? That comment doesn't make any sense here.
Score: 57 Votes (Like | Disagree)
djcerla Avatar
97 months ago
Apple under Tim Cook is slipping...
Reading comprehension is slipping faster, apparently.
Score: 39 Votes (Like | Disagree)
Tubamajuba Avatar
97 months ago
Apple under Tim Cook is slipping...
Apple is responsible for third party security breaches? Really now.

I've got an idea! Let's start reading articles instead of making baseless comments after glancing at a headline. Deal?
Score: 33 Votes (Like | Disagree)
Kaylor Avatar
97 months ago
Apple under Tim Cook is slipping...
What does Tim Cook have to do with people using weak passwords, using the same passwords between accounts, not changing them regularly, ect. ?
Score: 27 Votes (Like | Disagree)
BittenApple Avatar
97 months ago
Apple under Tim Cook is slipping...
Score: 15 Votes (Like | Disagree)
sziehr Avatar
97 months ago
This sort of thing makes me wonder why companies have not latched on more vigorously to things like touchID. I can not just impersonate that over the phone in a far off land. I have to get into your secure enclave or have your physical phone. This is the direction everything needs to go.
Score: 7 Votes (Like | Disagree)

Popular Stories

apple card 1

Apple Ending Apple Card Partnership With Goldman Sachs

Tuesday November 28, 2023 3:09 pm PST by
Apple is ending its credit card partnership with Goldman Sachs, according to The Wall Street Journal. Apple plans to stop working with Goldman Sachs in the next 12 to 15 months, and it is not yet clear if Apple has established a new partnership for the Apple Card. Apple and Goldman Sachs will dissolve their entire consumer partnership, including the Apple Card and the Apple Savings account....
iOS 17

Everything New in iOS 17.2 Beta 4

Tuesday November 28, 2023 12:18 pm PST by
Apple is wrapping up development on iOS 17.2, with the update expected to come out in December. While we're getting to the end of the beta testing period, Apple is still tweaking features and adding new functionality. We've rounded up everything new in the fourth beta of iOS 17.2. Default Notification Sound Under Sounds & Haptics, there's a new "Default Alerts" section that allows you to ...
iOS 17

Apple Releases iOS 17.1.2 With Security Fixes

Thursday November 30, 2023 10:12 am PST by
Apple today released iOS 17.1.2 and iPadOS 17.1.2, small updates to the iOS 17 and iPadOS 17 operating systems that Apple introduced in September. iOS 17.1.2 and iPadOS 17.1.2 come a few weeks after the release of iOS 17.1.1, another bug fix update. iOS 17.1.2 and iPadOS 17.1.2 can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update....
Apple 5G Modem Feature Triad

Apple to Discontinue Custom 5G Modem Development, Claim Reports

Wednesday November 29, 2023 4:19 am PST by
Apple is discontinuing in-house modem development after several unsuccessful attempts to perfect its own custom 5G modem chip, according to unconfirmed reports coming out of Asia. According to the operator of news aggregator account "yeux1122" on the Naver blog, supply chain sources related to Apple's 5G modem departments claim that the company's attempts to develop its own modem have...
All New CarPlay Five New Features Article 2

What to Expect From All-New CarPlay, Still Listed as Coming 'Late 2023'

Tuesday November 28, 2023 7:44 am PST by
At WWDC in June 2022, Apple previewed the next generation of CarPlay, promising deeper integration with vehicle functions like A/C and FM radio, support for multiple displays across the dashboard, increased personalization, and more. Apple's website still says the first vehicles with support for the next-generation CarPlay experience will be announced in "late 2023," but it has not shared...
Apple Logo

Apple Discontinued These 5 Products This Year

Monday November 27, 2023 7:03 am PST by
As the end of 2023 nears, now is a good opportunity to look back at some of the devices and accessories that Apple discontinued throughout the year. Apple products discontinued in 2023 include the iPhone 13 mini, 13-inch MacBook Pro, MagSafe Battery Pack, MagSafe Duo Charger, and leather accessories. Also check out our lists of Apple products discontinued in 2022 and 2021. iPhone Mini ...
iOS 17

iOS 17.1.2 Update for iPhone Likely to Be Released This Week

Monday November 27, 2023 8:24 am PST by
Apple will likely release iOS 17.1.2 this week, based on mounting evidence of the software in our website's analytics logs in recent days. As a minor update, iOS 17.1.2 should be focused on bug fixes, but it's unclear exactly which issues might be addressed. Some users have continued to experience Wi-Fi issues on iOS 17.1.1, so perhaps iOS 17.1.2 will include the same fix for Wi-Fi...
iOS 17

28 New Things Your iPhone Can Do in December's iOS 17.2 Update

Friday December 1, 2023 2:57 am PST by
Apple made the first beta of iOS 17.2 available to developers in October. Since then we've seen three more betas, and with each iteration Apple continues to add more new features and changes, many of which users have been anticipating for quite a while. Below, we've listed 28 new things that are coming to your iPhone when the finalized version is publicly released this December. 1. Help...