CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

iCloud Calendar Invites Abused for Callback Phishing Campaigns

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

A callback phishing campaign uses iCloud Calendar invites to send emails from Apple's servers. The emails mimic legitimate purchase notifications from PayPal, tricking recipients into calling a scammer's support number. This method allows the phishing emails to bypass spam filters and appear more legitimate. The scam involves creating an iCloud Calendar event with phishing text in the Notes field and inviting a Microsoft 365 email address. When the invite is sent, it appears to come from Apple's email servers, passing SPF, DMARC, and DKIM checks. The emails target multiple recipients through a Microsoft 365 mailing list, which forwards the invites to all group members. The phishing emails aim to scare recipients into thinking their PayPal account has been fraudulently charged, prompting them to call the scammer's support number. Once contacted, the scammer attempts to gain remote access to the victim's computer to steal money, deploy malware, or steal data.

Timeline

  1. 07.09.2025 20:10 📰 1 articles

    iCloud Calendar Abused for Callback Phishing Campaigns

    A callback phishing campaign uses iCloud Calendar invites to send emails from Apple's servers. The emails mimic legitimate PayPal purchase notifications, tricking recipients into calling a scammer's support number. The campaign leverages the legitimacy of Apple's email servers to bypass spam filters and target multiple recipients through a Microsoft 365 mailing list.

    Show sources
    Open in new tab

Information Snippets