MX Lab, http://www.mxlab.eu, started to intercept phishing emails with the subject “Validate Your Account Information” that will try to steal your Apple ID account information including your credit card details.
This email is send from the spoofed address “Apple <apple@support.com>” and has the following body:
Dear Customer,
We need to ask you to complete a short and brief step to securing and validating your account information.
Click here to complete validation
Failure to complete our validation process will result in a suspension of your Apple ID.
We take every step needed to automatically validate our users, unfortunately in your case we were unable to. The process only takes a couple of minutes and will make sure there is no interruption to your account.
Wondering why you got this email?
This email was sent automatically during routine security checks. We are not completely satisfied with your account information and require you to update your account to continue using our services uninterrupted.
For more information, see our FAQ.
Thanks,
Apple Customer Service
Screenshot of the email:
The URL leads to a malicious host at hxxp://31.204.130.145/~apple/secure/SenH37d3lPuNqeIc561gswPd6d4RN/ and here we find the My Apple ID login screen:
When signing in with dummy data we got the following form to fill in:
This form will gather all your account information, even your national insurance number (I assume they refer to the Canadian social insurance or SIN number ), and your credit card details.
