Connexion
iPhone Duo preorders officially launched last week to high demand, a quick sellout, and delayed delivery estimates. Naturally, scammers are finding ways to capitalize on the rush to obtain Apple's new foldable, so if you're in the market for a new device, be on the lookout for signs of compromise.
Soon after the iPhone Duo was announced, threat actors jumped into action, setting up fake preorder pages that looked like Apple's official website but were actually designed to deliver a malicious payloads to your device. As Malwarebytes outlined in late September, these pages promised a $500 voucher and AppleCare+ coverage in exchange for your contact information. But submitting the form isn't actually the scam. Rather, simply opening the page launches the attack, which uses the DarkSword exploit chain to bypass iPhone protections and gain access to cryptocurrency wallets, messages, contacts, emails, calendar entries, and location data.
This scam began several weeks ago and seemed to specifically target iPhones running iOS 18.4 to 18.6.2. Apple has said that devices running the latest versions of iOS 15 to 26 are protected from the exploit, so if your iPhone is up to date, you are likely at minimal risk for this specific scheme. That said, beware of websites and social media posts that promise access to the iPhone Duo faster or cheaper than other sources, as this is almost certainly a scam designed to steal your information or install malware on your device. Official sources for preorders include Apple itself (through the official Apple website or Apple Store app) as well as major cell carriers.
Another scam to be on the lookout for involves fraudulent charges for an iPhone Duo you didn't order. News outlets in Hong Kong have reported that shoppers are seeing transactions from Apple appear on their bank and credit card statements—even when they haven't actually tried to buy the device since preorders went live. This may be the work of bad actors who have harvested credit card details via phishing or data leaks and are using them for fraudulent purchases.
While this specific scheme doesn't appear to be widespread (yet), you should check your financial statements and accounts regularly anyway given how vulnerable your data are to theft and fraud. If you see a charge you don't recognize or duplicate charges, report it to your bank or card issuer immediately using contact information from a trusted app or client portal.
Scammers will also take the threat of fraudulent charges one step further: They may contact you directly about supposedly suspicious transactions and claim they can help resolve the issue if you provide personal information or account credentials. With the iPhone Duo specifically, bad actors may also call pretending to be Apple or a carrier and ask you to confirm information about your order, possibly to avoid having it canceled. As always, any communication that provokes fear and a sense of urgency should raise red flags. If you're not sure who you're talking to, hang up and call back directly to confirm.
If you get a security pop-up while you're browsing online alerting you to an unauthorized charge attached to one of your accounts, don't panic, and don't act impulsively. Scammers are currently using these alerts to impersonate Apple and Amazon support (and possibly others) to convince people that their accounts have been compromised and need to be verified to prevent further fraudulent activity. Naturally, this is just a ruse designed to gain access to your device or accounts, which will do far more damage than the fake alert itself.
This campaign, described by Malwarebytes Labs, starts with a browser pop-up that appears on top of Apple's or Amazon's website. The alerts are designed to look like legitimate notifications and state that the user's Apple ID or Amazon account was recently used to make a $149.99 purchase. Targets are urged to call the support number listed—the same on both pop-ups—immediately to prevent further unauthorized activity. The scammer on the other end of the line may try to convince you to download a tool that provides remote access to your device, hand over credentials, or even pay a fee to protect your account.
If you Google the number listed in this specific campaign, you'll find a fake Amazon support website ("amazonhelp[dot]support") set up by fraudsters to make the scheme look more legitimate—of course, the real Amazon customer service site is hosted on amazon.com. Other scam hallmarks present here include manufactured urgency, technical jargon, and a dollar amount that's just enough to get your attention but not so high that it seems like an obvious fake.
First things first: no legitimate company will send you security alerts via browser pop-up. If there's an issue with your account, you may receive an in-app notification or an email, though you should always be wary of the latter, as it's also a common vector for scams. To confirm whether these alerts are real, log into your account by going directly to the website or app and check your message history or activity log.
It's also worth noting that you won't dispute fraudulent charges with customer support over the phone. In fact, you're far more likely to deal with your bank or credit card issuer directly for this, and you may actually get a fraud notification from a financial institution first in the event of a suspicious purchase. Calling a number from a browser pop-up is not the way. Do not give out account information to anyone over the phone unless you have verified the number, such as by clicking through the company's app, and initiated the call yourself.
Finally, these fake pop-ups may be the result of malicious ads, browser redirects, or compromised sites, all of which are used in phishing campaigns. If you're served one, exit the tab immediately and do not click or engage with it further.
Scammers love to impersonate trusted brands—ranging from big tech names like Microsoft and Google to password managers and payment apps—in their phishing campaigns to lure their marks, and their latest guise is Spotify. A new email is circulating alerting users to supposed payment issues, prompting them to hand over their credit card details and Spotify login credentials.
As The Guardian reports, Spotify users have received messages with the subject line "review billing info" claiming that the platform "encountered an issue while processing your recent payment." Recipients are urged to "review and update" their information to keep their accounts active. The button in the email directs users to a spoofed website, where users are prompted to enter their username and password, followed by their credit card number, address, and phone number—everything scammers need to make fraudulent purchases. One victim reported seeing a suspicious charge for more than $600 within minutes of handing over their information.
The emails closely replicate Spotify's branding, including its colors and logo, and appear to come from a sender called MySpotify. The fraudulent website also looks convincing at first glance. However, unlike some of the more sophisticated phishing schemes that exploit vulnerabilities in order to use real domains (like Google and PayPal), this one from Spotify breaks down when you look closer.
For one, both the sender's address and the website URL clearly are not connected to spotify.com or any legitimate subdomain. The subject line is all lowercase, and there are no specifics about users' subscriptions or accounts in the email body.
Payment issues are a common scam tactic, and you should always be skeptical of any communication that urges you to provide or update banking or credit card info (or sends you to a login page along the way, which is designed to harvest your credentials). If you receive a notification from Spotify about failed payments, don't click links, download attachments, or reply. Spotify won't request payment info, passwords, or other sensitive information over email.
If you're concerned about a payment or subscription problem, go directly to your account in the Spotify app or a web browser instead. If you've already entered your Spotify credentials into a suspicious site, change your password and keep an eye on your credit card transactions to catch any fraudulent charges. You can also forward phishing emails to spoof@spotify.com.
You trust your password manager to keep your credentials, documents, and identity data secure—and you probably also trust notices that come from your password manager with steps to maintain that security. Scammers are counting on this: A new phishing campaign is targeting LastPass and Bitwarden users with fake security alerts designed to compromise their data and devices.
Earlier this week, LastPass alerted users to an impersonation scam in which threat actors are sending phishing emails that look like official security notices. The messages come from hello[at]lastpassnewsletter[.]com with the subject line "Action Required: Review Updated LastPass Security Policies."
In the email body, attackers outlined supposed changes to LastPass security monitoring and reporting protocols and noted that users "have 14 business days to review and accept the updated terms" via DocuSign. The link redirected to https[:]//lastpasscompliance[.]com/, which looked like a legitimate DocuSign page complete with a chatbot window, and prompted users to "download" DocuSign in order to review and sign the document. It's unclear whether the goal was to spread malware or harvest user credentials, as the malicious website has since been taken down. However, Bitwarden users have been targeted with a nearly identical campaign, according to BleepingComputer.
On the surface, the phishing emails targeting LastPass and Bitwarden users are pretty convincing. They have some technical jargon, so users may skim over the specifics and trust that the information is legitimate. There's a call to action, but the email states that users have 14 days to accept the terms or their account "may be temporarily restricted"—so the urgency is slightly lower than with some other scams. The email even reassures users that their vaults and accounts are "completely secure" and states that the required steps are "strictly" administrative in nature.
That said, both the sender and the URL should raise suspicion. Neither lastpassnewsletter[.]com nor lastpasscompliance[.]com are official LastPass domains, nor is bitwardencompliance[.]com a real Bitwarden site. Never enter your master password or other credentials unless you navigate directly to your password manager's website or vault—links from emails, texts, or social media messages are at risk of being phishing attempts. If you've supplied your credentials to a suspicious site, update them immediately from a trusted device. You also shouldn't need to download software or use DocuSign for your password manager, and any actions on your account should occur when you are logged in to the legitimate site or vault.
It's rough out there for job seekers, and scammers are preying on candidates hoping to get hired by well-known companies. A new phishing campaign uses fake interview invites—impersonating brands like Adidas, Netflix, Adobe, and FIFA—to steal users' Google account credentials.
Employment scams are nothing new, and they come in a variety of flavors, from fake job offers sent via text to fake applications distributed via Google Forms. Netflix impersonators even ran a similar recruitment email campaign last year. Bad actors are typically trying to phish personal information or convince you to send them money for various (fake) onboarding expenses.
As BleepingComputer reports, this job scam primarily targets marketing professionals looking for positions with high-value companies across multiple sectors, including tech, hospitality, travel, food, entertainment, and luxury goods.
The fraud begins with a phishing email from a "recruiter" at one of more than 34 companies, inviting candidates to schedule a meeting to discuss further. Scammers appear to be using the names and photos of real recruiters at these companies, making them less likely to raise suspicion if targets try to verify their legitimacy.
If a job seeker clicks the link to the recruiter's calendar, they'll be redirected multiple times and ultimately land on a malicious website designed to look like a real interview scheduling page. From there, they'll be prompted to sign in with Google, which launches a fake login interface that looks like Google's authentication pop-up but is actually just part of the phishing page. (This is an example of a browser-in-the-browser (BitB) attack.)
Threat actors appear to be using a legitimate HR platform called PeopleForce and a domain operated by Salesforce to initiate the scam, though it's not clear whether they created accounts or are using stolen credentials.
Like all scams, this one preys on emotion, like the excitement of being recruited for a highly desirable position in a competitive job market. If you receive an unsolicited message from a recruiter, whether via email, LinkedIn, or some other social platform, proceed with caution—especially if you haven't applied for a job or the opportunity sounds too good to be true. If you're not sure, go directly to the company's careers page to find the listing.
Just because a calendar or application link appears to go to a legitimate site doesn't mean you're safe. Obviously, scammers have many ways of spoofing URLs or redirecting traffic so you don't realize you're being phished. Look carefully at the address bar on the final window for sneaky characters or other URL tricks.
If you're being prompted to enter single sign-on credentials (such as Apple, Google, or Facebook) to schedule an interview or fill out an application, this is a red flag. Try to interact with the pop-up, such as by dragging it away from the main browser window or highlighting the URL. If you can't, it's likely a fake. A password manager can also protect against BitB attacks, as these tools won't fill credentials, except on the legitimate domain.
If you see a receipt in your Shop app for a purchase you didn't make, proceed with caution. Scammers have managed to insert fake orders—that appear to be from legitimate companies like Apple, Norton, and PayPal—into Shop users' histories as part of a callback phishing campaign.
Fake purchase receipts are a favorite scam tactic for PayPal impersonators, who frequently use email notifications to trick targets into calling a fraudulent support number or clicking a phishing link.
As BleepingComputer reports, Shop users are seeing fake invoices in addition to real purchases in their order tracking history. These fraudulent receipts may say that a charge (usually for a large amount) has been processed, an order has been prepared, or a subscription has been renewed.
They also list an email and/or phone number for disputing the purchase, but if you call, you'll reach scammers pretending to be support agents. The goal is to get customers to hand over personal information like login credentials, credit card information, or authentication codes or even download malware that lets scammers remotely access your device.
Researchers at cybersecurity firm Gen Digital, which identified the scam, found that these fake purchase notifications contain some obvious red flags, like poor grammar and spelling. However, Shop is a widely used and largely trusted app, so users have little reason to suspect a scam and therefore may be more likely to call a support line or engage with a receipt in some way. Plus, a notification inside an app may raise fewer alarms than a phishing email.
Your Shop history tracks orders paid for with Shop Pay and purchased from stores that use Shopify as long as you entered the email associated with your Shop account at checkout. It also pulls tracking information from Gmail and Outlook by scanning messages for keywords like "tracking number" and "track your package," so you may see pending deliveries that originated outside the Shop ecosystem.
Researchers note that it's not clear exactly how threat actors are inserting fake orders into user histories, nor is there evidence that Shop, Shopify, or any companies being impersonated have been breached. Shop has simply said that they are implementing "new controls" to mitigate the issue.
Don't automatically assume a receipt for an unknown purchase is legitimate, whether it pops up in the Shop app or your email. Check your bank or credit card statements as well as your account history with the listed vendor to see if there's a purchase that matches. If you don't find one, the invoice itself is almost certainly a scam, and you should not engage with it. Don't call the number, send an email, or click any links.
If you haven't done any of these things, you can just ignore the notification or report it directly to Shop and the listed vendor. If you've called or given up any information, change your password (ideally on a different device) and keep an eye on any suspicious login attempts or unfamiliar charges on your accounts.
Lateo.net - Flux RSS en pagaille (pour en ajouter : @ moi) 