Apple account change notification phishing campaign
Campaign
Summary
Hide ▲
Show ▼
A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authentic and more likely to bypass spam filters. The messages embed a $899 PayPal purchase warning and push recipients to call a scammer-controlled support number. Header evidence suggests the emails may be distributed to multiple targets rather than a single recipient.
Related Happenings
Bitter Middle East spear-phishing campaign targeting civil society figures
Campaign
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
A **spear-phishing campaign** targeted **civil society figures in Middle Eastern countries**, including **three journalists in Egypt and Lebanon**, creating account-compromise ris...
Bitter Middle East spear-phishing campaign targeting civil society figures
CampaignAbout this happening: A **spear-phishing campaign** targeted **civil society figures in Middle Eastern countries**, including **three journalists in Egypt and Lebanon**, creating account-compromise ris...
Unnamed high-profile Lebanese journalist hit by network compromise
Incident
First: 09.04.2026 13:45
Last: 09.04.2026 13:45
Sources 1
About this happening:
An **unnamed high-profile Lebanese journalist** had an **Apple account** successfully compromised in **2025**, creating unauthorized access to a personal and professional identity...
Unnamed high-profile Lebanese journalist hit by network compromise
IncidentAbout this happening: An **unnamed high-profile Lebanese journalist** had an **Apple account** successfully compromised in **2025**, creating unauthorized access to a personal and professional identity...
Starkiller dark-web phishing platform scales credential theft as a SaaS-style criminal service
Threat Actor Meta
First: 19.02.2026 14:00
Last: 19.02.2026 14:00
Sources 1
About this happening:
The **Starkiller** phishing platform has emerged as a **SaaS-style criminal service**, raising the scale and durability of credential theft operations. It is sold on the **dark we...
Starkiller dark-web phishing platform scales credential theft as a SaaS-style criminal service
Threat Actor MetaAbout this happening: The **Starkiller** phishing platform has emerged as a **SaaS-style criminal service**, raising the scale and durability of credential theft operations. It is sold on the **dark we...
PayPal Subscriptions fake purchase email scam campaign
Campaign
First: 14.12.2025 18:06
Last: 14.12.2025 18:06
Sources 1
About this happening:
The **PayPal Subscriptions** email scam is **abusing legitimate PayPal mail** to deliver **fake purchase notifications**, increasing the chance that messages evade filtering and r...
PayPal Subscriptions fake purchase email scam campaign
CampaignAbout this happening: The **PayPal Subscriptions** email scam is **abusing legitimate PayPal mail** to deliver **fake purchase notifications**, increasing the chance that messages evade filtering and r...
China-based smishing and fake e-commerce phishing campaign
Campaign
First: 05.12.2025 01:02
Last: 05.12.2025 01:02
Sources 1
About this happening:
A **China-based phishing campaign** has escalated into mass-registered scam domains and **SMS lures** for rewards points, tax refunds, and fake retail deals, increasing risk for *...
China-based smishing and fake e-commerce phishing campaign
CampaignAbout this happening: A **China-based phishing campaign** has escalated into mass-registered scam domains and **SMS lures** for rewards points, tax refunds, and fake retail deals, increasing risk for *...
Timeline
-
19.04.2026 19:03 1 articles · 1mo ago
Apple ID profile change triggers phishing alert
Exploitation ObservedA threat actor creates an Apple ID, splits callback-phishing text across the first and last name fields, and updates shipping information so Apple generates a legitimate account-change notification that carries a fake $899 iPhone purchase via PayPal and a callback phone number.
Show sources
- Apple account change alerts abused to send phishing emails — www.bleepingcomputer.com — 19.04.2026 19:03
-
19.04.2026 19:03 2 articles · 1mo ago
Apple account change notification phishing campaign disclosed
Initial DisclosureSecurity analysis documents that Apple account change notifications were abused to send callback-phishing emails from [email protected], with SPF, DKIM, and DMARC passing and with the lure embedded in user-supplied name fields; Apple had not responded after being contacted about the abuse.
Show sources
- Apple account change alerts abused to send phishing emails — www.bleepingcomputer.com — 19.04.2026 19:03
- Apple account change alerts abused to send phishing emails — www.bleepingcomputer.com — 19.04.2026 19:03