Advisory on Phishing Texts Targeting Apple iMessage Users

These messages often appear to come from legitimate sources and may request the user to reply with simple commands, such as "Y". The act of replying turns off iMessage's built-in phishing protection for this text. Once these protections are disabled, links from unknown senders become clickable, exposing users to significant cybersecurity risks. The goal of this campaign is to trick users into interacting with malicious links, potentially leading to:

• Theft of sensitive personal information

• Installation of malware or spyware

• Financial or account-related fraud

With phishing attacks becoming increasingly sophisticated, it is critical for users to remain cautious and informed.

Recommendations

To protect yourself, do follow these measures:

• Do not reply to unsolicited messages from unknown senders.

• Keep the “Filter Unknown Senders” setting enabled to block clickable links from unverified contacts.

  • Go to Settings > Messages > Filter Unknown Senders

• Verify suspicious messages directly with the purported sender through official channels, or by calling the anti-scam hotline at 1799.

• Be cautious of links in messages, even from known contacts.

• Report suspicious SMS messages through the ScamShield app or submit them via ScamShield’s website.

• For phishing messages that appear to come from Apple, take a screenshot and email it to reportphishing@apple.com.

What to Do If You Have Responded

If you have interacted with a phishing text or followed its instructions, you are advised to take the following steps immediately:

• Block the Sender

• Prevent further messages by blocking the sender.

• Monitor for Unusual Activity

• Alert your bank promptly if you have revealed your banking details or credit card credentials.

• Regularly check your Apple ID and financial accounts for unauthorised modifications or transactions.

• Scan for Suspicious Links or Apps

• Do not click on any links sent by the phishing SMS.

• If you observe any suspicious applications installed or installed any applications under instruction, uninstall them immediately.

• Change your Password Immediately

• If the same password is used on other accounts, change those too. Use a strong passphrase and be sure to use a different passphrase for each of your accounts.

• Report the Incident

• Lodge a police report if you incurred any monetary losses.

Conclusion

Smishing attacks are becoming increasingly sophisticated, targeting unsuspecting users through legitimate-looking messages. Staying informed and cautious can help protect your personal and financial information. By following the recommended measures, you can significantly reduce your risk of falling victim to such attacks.

References:

https://www.csa.gov.sg/our-programmes/cybersecurity-outreach/cybersecurity-campaigns/the-unseen-enemy-campaign/beware-of-phishing-scams

https://www.bleepingcomputer.com/news/security/phishing-texts-trick-apple-imessage-users-into-disabling-protection/?utm_source=tldrinfosec