Campaign
campaign:apple_icloud_phishing_campaign
Derived label for the targeted phishing activity used to obtain celebrity iCloud credentials during the episode’s account-compromise events.
Derived label for the targeted phishing activity used to obtain celebrity iCloud credentials during the episode’s account-compromise events.
“sending phishing e-mails to get into their iCloud logins”
“There was this underground group of hackers that were hitting hundreds and hundreds of people with these phishing attacks”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 34 |
| outgoing | INVOLVES | credential harvesting | Explicit | 34 |
| outgoing | INVOLVES | targeted open source intelligence-gathering | Explicit | 34 |
| outgoing | INVOLVES | Brute-force attack | Explicit | 34 |
Apple iCloud phishing campaign INITIAL_ACCESS_VIA phishing
The celebrity-account campaign obtained initial access through phishing emails and cloned login pages.
Explicit Confidence 99% · Jack Rhysider EP 34 Details
“the hacks were done by targeting individual people and then sending phishing e-mails to get into their iCloud logins.”
Apple iCloud phishing campaign INVOLVES credential harvesting
The cloned iCloud page captured usernames and passwords in clear text.
Explicit Confidence 99% · Jack Rhysider EP 34 Details
“it would save that in clear text so the hacker could see it”
Apple iCloud phishing campaign INVOLVES targeted open source intelligence-gathering
Attackers researched specific celebrities to find their email addresses and account-related information.
Explicit Confidence 99% · Jack Rhysider EP 34 Details
“First they did targeted open source intelligence-gathering on specific celebrities to try to find their e-mail address.”
Apple iCloud phishing campaign INVOLVES Brute-force attack
Some attackers used iDict to cycle through commonly used passwords against iCloud accounts.
Explicit Confidence 99% · Jack Rhysider EP 34 Details
“Basically it’s a brute force login tool.”