Mac Users Should Be Wary of New Phishing Scheme
Mac users should take note: A well-known (and relatively sophisticated) phishing scheme that previously targeted Windows is now redirecting to macOS and Safari in an attempt to obtain login credentials (your Apple ID).
On Windows, this scam worked by displaying fake security alerts on compromised websites, claiming that the user’s device was “compromised” or locked, while malicious code caused the website itself to freeze (making the scam more convincing). The notification prompted users to enter their Windows credentials to regain access – apparently passing them directly to attackers to take over their accounts. Users were also advised to call a fake hotline, where they were forced to pay a ransom or allow remote access. to their cars.
According to a scam report from LayerX Labs , the attack was successful for more than a year—in part because the alerts mimicked real Microsoft notifications so well, with sophisticated phishing sites hosted on the legitimate Microsoft domain (windows[.]net) and randomized subdomains that changed frequently.
How this phishing campaign works on Mac
As 9to5Mac notes , the campaign quickly pivoted to macOS and Safari after antivirus software was released for Edge, Chrome, and Firefox in February. It works similarly with pages and text modified for Mac. You can become a target in Safari if you mistype the URL when trying to access a legitimate website, after which you are redirected through a compromised “parking” page to a phishing attack page. As with Windows, you may be prompted to enter your Apple credentials to resolve the issue.
LayerX Labs says phishing campaigns targeting Macs “rarely reach this level of sophistication,” although screenshots of security pop-ups included in the report contain spelling errors and do not match Apple’s style. As always, be critical of any messages or alerts that appear urgent or request sensitive information, as you will usually be able to spot such inconsistencies.
Otherwise, make sure you enter the correct URL of the sites you want to visit, or search for them on Google and scroll through the ads to the actual results before clicking on them. Keep up to date with security updates from Apple so you can download and install patches as soon as they are released.