SEC Consult Research 20261001 :: Arbitrary Email sender spoofing in Apple iCloud mail
SEC Consult disclosed sender spoofing in Apple iCloud Mail SMTP; Apple fixed it, with no CVE assigned.
Stories per day · 30 days
3 RSS
6 stories, newest first · one card per story
Stories tagged #email-spoofing
From: anyone@icloud.com - Spoofing Arbitrary Apple iCloud Identities
SEC Consult showed header smuggling can spoof arbitrary sender addresses on Apple iCloud.
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats
Weekly roundup: iCloud spoofing bugs bypass SPF/DKIM/DMARC, TA419 spies phish AI policy experts, Cloudflare fixes cross-tenant data leak, Poper Blocker harvests AI chats.
Free iCloud Account Could Let Attackers Spoof Any @icloud.com Address and Pass Email Security Checks
Two patched Apple iCloud SMTP parsing flaws let free accounts spoof any @icloud.com address while passing SPF, DKIM, and DMARC checks.
Revolut discloses data breach exposing financial info, passports
Revolut disclosed a breach after a threat actor spoofing a government agency's email domain obtained customer passports, selfies, IBANs, and full transaction histories.
4
AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims
DEF CON 34 research shows AI customer-service agents can be manipulated via prompt injection and email tricks to leak OTPs and act as victims.
3