Recently, a stolen iPhone was attempted to be unlocked by thieves that sent a fake iCloud login to the original owner, two months after it was stolen. Attempts such as this highlight the fact that thieves are now using a combination of both physical theft and phishing attempts to unlock stolen iPhones.
Phillip Caudell, a resident of the UK had lost his iPhone – and – two months later, he received an iCloud login notification which revealed that the phone was now in Algiers, the capital city of a North African country.
“Nearly 2 months later my stolen iPhone has shown up in Algiers! It’s locked with a message saying to call me if found, but instead, the thieves used my number to send a fake iCloud login (so they can unlock it). Clever – wonder how many people fall for this?” tweeted Phillip.
iPhones accept only a single iCloud account at a time. So if a device gets stolen, the current iCloud account has to be logged out to sell the phone or access it. For logging out of the current iCloud account of the original user, the only way is to know the password.
As the thieves cannot possibly get a hold of the users’ passwords, they simply go about by phishing and hacking their way into an iPhone. There are several phishing kits such as the AppleKit and ProKit that can be used for phishing and unlocking an iPhone.
In the previous year, Kseniya Turova, social media manager for Kaspersky published a blog post detailing the phishing efforts carried out by a thief after she lost her iPhone in a crowded bar in Mexico.
After stealing her phone, the thief sent her a message containing a link to view the phone’s location and that the recent location details would be available in twenty-four hours. Upon clicking the link to view the iPhone’s location, she landed on a fake iCloud login page.
Turova, unfortunately, entered her real credentials and the fake iCloud page ended up displaying an error message saying that she entered the wrong password. She then realized that the thief had accessed her iCloud account through a successful phishing attempt and managed to erase all her information off the device.
The psychological stress that comes with losing a valuable device such as an iPhone lures people into giving away their sensitive information such as the iCloud credentials which will allow thieves to simply hard reset the phone, erase all the information and resell it.
The combination of both physical theft alongside cyber phishing attempt is something every iPhone user needs to be wary of. If you happen to lose your iPhone, it’s advisable to watch out for potential phishing attempts. Do not respond to fraudulent emails or text messages asking you to provide your login credentials for proving that it’s your device.
If you're tired of censorship and dystopian threats against civil liberties, subscribe to Reclaim The Net.
