In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats
Weekly roundup: iCloud spoofing bugs bypass SPF/DKIM/DMARC, TA419 spies phish AI policy experts, Cloudflare fixes cross-tenant data leak, Poper Blocker harvests AI chats.
SEC Consult researcher Timo Longin disclosed two iCloud flaws allowing attackers to send emails from arbitrary icloud.com addresses that pass SPF, DKIM and DMARC, fully fixed in December 2025 with a $15,000 Apple bounty. Proofpoint detailed TA419, a new China-aligned espionage group that phished AI policy experts via a fake OneDrive page and adversary-in-the-middle proxy capturing MFA session cookies. Cloudflare patched a Containers/Sandboxes flaw letting Workers Paid customers recover residual cross-tenant data including SQLite databases, with no evidence of malicious exploitation. Other items include 100+ Kiteworks advisories (a dozen critical), Poper Blocker extension collecting AI chats from 2M+ users, and two US airmen sentenced for $1.68M+ BEC fraud.
- iCloud mail-spoofing flaws allowed sending from icloud.com passing SPF, DKIM, DMARC; Apple paid $15,000
- TA419 phishing of AI policy experts uses AitM OneDrive proxy to steal MFA session cookies
- Cloudflare patched Containers bug exposing residual cross-tenant data; no malicious exploitation found
- Kiteworks released 100+ advisories; a dozen critical Email Protection Gateway bugs enable account takeover
- Poper Blocker Chrome extension, 2M+ users, collects browsing history and ChatGPT/Claude/Gemini conversations
- Threat actors
- TA419
From the original article
3 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: Kiteworks patches over 100 vulnerabilities, Microsoft publishes 2026 Digital Defense Report, AI finds 24 Android app flaws. The post In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.