Premium

Phishing alert: How Apple users are being tricked into disabling an important iMessage security feature

Scammers are apparently sending fake toll tax and delivery issue messages with links that may take users to a malicious website.

Apple has no manufacturing facilities in Indonesia, a country of about 280 million people, but has since 2018 set up application developer academies. (Image: Reuters)

Cybercriminals are tricking Apple iMessage users into turning off the app’s built-in phishing protection, leaving them vulnerable to scams and frauds. While iMessage automatically disables links in messages from senders that are not in your contact list, threat actors seem to have stumbled across a new way to turn off the built-in protection mechanism.

According to a recent report by Bleeping Computer, scammers are sending unsuspecting users messages to fake USPS shipping issues and unpaid toll text with unclickable links and asking them to reply with the word “Y” to enable the link. “Please reply Y, then exit the text message, reopen the text message activation link, or copy the link to Safari browser to open it”, reads one of the phishing messages.

Also Read | WhatsApp may replace ‘Communities’ tab with ‘AIs’: Here’s what it will do

Here is an example of phishing SMS sent by scammers.

Here is an example of a phishing SMS sent by scammers. (Image Source: Bleeping Computer)

If users reply to the message with the text, iMessage’s built-in phishing will be disabled and the links embedded in the message will become clickable. Apple says links received in messages become clickable when a user responds to a message or adds a number to their contact list.

The report goes on to say that even if the user does not click on the link, the act of replying alerts the threat actor that the number is active and may fall victim to scams. While most tech-savvy users may be easily able to spot the scam, this method of phishing is targeted at people who are not familiar with such scams and think that the message might be genuine.

To protect yourself against such attacks, make sure you do not respond to such texts. In case you are unsure if a text is legitimate or not, you can copy the content of the message and use AI-powered scam detectors like Norton Genie, Trend Micro ScamCheck or Bitdefender Scamio.