Uncovering the Dark Side: iPhone Farms Flood with Over 100,000 Scam iMessages Daily
iPhone Farms Fueling Spam iMessages Security researchers have uncovered a new method of scam operation involving 'iPhone farms'—collections of iPhones equipped with rotating temporary Apple IDs used to send over 100,000 scam iMessages daily. By leveraging iMessage, scammers can bypass the spam and scam filters implemented by mobile carriers due to encryption. This makes it impossible for networks to detect or block these messages.
Common Scams
Typical scams include fake demands for unpaid road toll fees, claims that shipping fees are needed to release valuable packages from customs, and fictitious warnings about unpaid taxes. These phishing attempts often come via email and text message, but the use of iMessage has become a new avenue due to its encrypted nature.
Phishing-as-a-Service (PhAAS)
The Chinese platform Lucid offers a sophisticated PhAAS model that enables large-scale phishing campaigns. The XinXin group, behind Lucid, sells phishing templates designed to impersonate postal services, courier companies, road toll systems, and tax refund agencies. These templates help scammers create convincing replicas of websites.
Scale and Impact
Catalyst, a cybersecurity firm, has found that the Lucid platform targets 169 entities across 88 countries. The PhAAS model is subscription-based, making it accessible to cybercriminals who can conduct campaigns to harvest credit card details for financial fraud.
Protection Tips
To protect against these scams, users are advised:
- Never click on links in messages or emails; instead, use bookmarks or type in known URLs.
- Do not trust apparent senders and be wary of urgent requests to avoid fines or package returns.
- Stay informed about the latest phishing techniques and security measures.
