Massive Phishing Attack Targets iTunes Customers
Cleverly-crafted email tells users there is a problem with a purchase they haven't made, PandaLabs says
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Apple's popular iTunes platform has become a major target for hackers looking to steal credit card data from the service's millions of users, a research lab reports.
According to PandaLabs, victims of the new phishing exploit receive a cleverly crafted email with a phony receipt informing them that they have made an expensive purchase on iTunes. The user, having never made the purchase, is concerned by the email and naturally tries to resolve the problem --- by clicking on the proffered fake link.
After clicking the link, the victim is asked to download a fake PDF reader. Once installation is complete, the user is redirected to an infected Web page containing the Zeus Trojan, which is specifically designed to steal personal data. This phishing attack was uncovered shortly after a similar phishing attack targeting LinkedIn users appeared last week, which appears to have originated in Russia.
"Phishing is nothing new," said Luis Corrons, technical director of PandaLabs. "What never ceases to surprise us is that the techniques used to trick victims continue to be so simple, but the design and content is so very well-orchestrated. It's very easy to fall into the trap. When using services such as iTunes, it is absolutely crucial that users never go to the website via email, but rather from the platform itself, where they can verify their account status."
This new scam has been reported to the Anti-Phishing Working Group, which has started to block some of the Web addresses linked to in the fake email, PandaLabs says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024