Apple Passwords App Bug Left Users Vulnerable to Phishing Attacks for Months Before Being Fixed - MacRumors
Skip to Content

Apple Passwords App Bug Left Users Vulnerable to Phishing Attacks for Months Before Being Fixed

Apple fixed a bug in its Passwords app with December's iOS 18.2 update that had left users vulnerable to phishing attacks in the three months since the launch of iOS 18.

Generic iOS 18 Passwords Feature
According to an Apple security update spotted by 9to5Mac, the Passwords app was sending unencrypted requests for the logos and icons associated with users' stored passwords.

Without protections of encryption, an attacker on the same Wi-Fi network could redirect a user's browser to a clone phishing site where login details could be stolen. The vulnerability was first discovered by developer Mysk's security researchers and reported in September.

Apple's iOS 18.2 security release notes described the bug like so:

Impact: A user in a privileged network position may be able to leak sensitive information

Description: This issue was addressed by using HTTPS when sending information over the network.


Apple lists the bug in security content updates for the Mac, iPad, and Vision Pro, indicating that this issue was fixed across multiple OSes.

Popular Stories

macbook ultra

'MacBook Ultra' Coming Soon With These 12 New Features

Friday July 24, 2026 6:00 pm PDT by
Apple's first high-end MacBook redesign in five years is expected to arrive in the near future, bringing a run of firsts to the Mac. Bloomberg's Mark Gurman expects the laptop to arrive between late 2026 and early 2027, with the later window now looking more likely owing to the global memory chip shortage. Analyst Ming-Chi Kuo expects mass production to begin by late 2026. Apple last...
iPhone 18 Pro Deep Red Feature

iPhone 18 Pro Launching in Two Months With These 12 New Features

Friday July 24, 2026 7:26 pm PDT by
It is now late July, and that means the iPhone 18 Pro and iPhone 18 Pro Max are less than two months away. The devices are expected to look similar to the iPhone 17 Pro and iPhone 17 Pro Max, but there will still be many year-over-year changes, with rumored features including a smaller Dynamic Island, 5G via satellite, and more. Apple is expected to unveil the iPhone 18 Pro, iPhone 18 Pro...
5 Reasons to Buy the iPhone 17 Now Feature

5 Reasons to Buy the iPhone 17 Now Instead of Waiting for iPhone 18

Thursday July 23, 2026 8:26 am PDT by
Apple's iPhone 18 Pro models and its first foldable are less than two months from being unveiled. That may sound like a reason to sit tight if you're looking to upgrade from an iPhone 16 or older series, but between looming price hikes and Apple's new split-launch calendar, there's a decent case for grabbing an iPhone 17 series model right now. Here are five reasons in favor of putting your order ...

Top Rated Comments

18 months ago
This bug is so basic that Apple must be embarrassed, as they should have some of their people verify security when they make their first passwords app, which is going to be used by millions 🫢
Score: 28 Votes (Like | Disagree)
wanha Avatar
18 months ago

If this… and if that… and only if this…. There might be an opportunity to do something.

But it’s fixed now.

When someone comes up who has actually been affected then I’ll join the whingers and complain.

It’s like saying a driver could drive through a red light and cause an accident. But it didn’t happen!!! And until it does.
Did you just say that you'll only complain about people driving through red lights once they cause an accident?
Score: 13 Votes (Like | Disagree)
code-m Avatar
18 months ago
Privacy and Security 🤭
Score: 13 Votes (Like | Disagree)
MrRom92 Avatar
18 months ago
And through all the betas of iOS 18 nobody caught this
Score: 12 Votes (Like | Disagree)
code-m Avatar
18 months ago

This bug is so basic, that Apple must be embarrassed as they should have some of their people verify security when the make their first passwords app, that is going to be used by millions 🫢
Needs to be on the local wifi network, if you are using public wifi even at school or work the potential of being compromised would be there. If only at home no biggy unless your neighbours are creeps.
Score: 10 Votes (Like | Disagree)
Pitogyro Avatar
18 months ago
There's only so many rescources they have and there was genmoji to launch.
Score: 7 Votes (Like | Disagree)