Greg's Corner

Scammers Find New Way into Your iPhone

By Greg Collier

In an era where smartphones are central to our lives, the prevalence of mobile-focused cyber threats has grown exponentially. One such tactic, known as smishing, phishing through SMS, has become a favored method for cybercriminals to exploit unsuspecting users. Recently, reports from Bleeping Computer have highlighted an alarming trend where attackers leverage a subtle trick to bypass Apple iMessage’s built-in phishing protection, putting users at risk.

Apple iMessage is designed with user safety in mind. One of its protective measures disables links in messages sent from unknown senders, whether from an email address or a phone number. This proactive approach ensures that potentially malicious links cannot be easily accessed by recipients. However, Apple has confirmed that this safeguard can be unintentionally disabled if the user replies to the message or adds the sender to their contact list.

This is where cybercriminals have found an opening. Over recent months, there has been a noticeable rise in smishing campaigns that aim to deceive users into replying to suspicious texts. These messages often impersonate trusted organizations, claiming issues such as unpaid road tolls or shipping problems. They instruct recipients to reply with a specific response, such as ‘Y’, under the guise of resolving the issue or enabling a necessary link. This simple act reactivates the links in the text and disables iMessage’s phishing protection for that specific sender.

This strategy exploits common behaviors. Many people are accustomed to replying with terms like ‘Yes’, ‘No’, or ‘STOP’ to confirm appointments or manage subscriptions. Cybercriminals bank on this familiarity to prompt a reply, effectively bypassing the safeguards that initially protected the user. Beyond enabling links, the act of replying signals to the attacker that the recipient is engaged and potentially vulnerable, increasing the likelihood of future targeting.

This tactic poses a significant risk to less tech-savvy users, including older adults, who may be more trusting of such messages. Once the phishing links are enabled, clicking them can lead to fraudulent websites designed to harvest personal information, financial details, or other sensitive data. Even those who don’t click the links but respond to the message may find themselves targeted by a higher volume of scams.

If you encounter a message from an unknown sender with disabled links or instructions to reply, it’s critical to exercise caution. Do not reply or interact with the message. Instead, contact the purported organization directly through official channels to verify the legitimacy of the communication. Remaining vigilant and skeptical of unsolicited messages is the best way to protect yourself and your personal information in the face of these evolving threats.

Cybercriminals are constantly refining their techniques to exploit unsuspecting users. By understanding these tactics and staying alert, you can shield yourself from the risks they pose and help others do the same.