Smashing Security This clever scam nearly hijacked a tech CEO's Apple ID
27 snips
Mar 19, 2026 Paul Ducklin, experienced cybersecurity commentator, breaks down a near-miss Apple ID takeover that used MFA fatigue, real-looking Apple alerts, a convincing support call, and a pixel-perfect phishing page. He also explores privacy risks in medical data sharing with UK Biobank and how small data points can re-identify people. Plus a quirky look at human-powered “AI” and a satirical RSA punishment.
AI Snips
Chapters
Transcript
Episode notes
Why MFA Fatigue Works Like A Denial Of Service
- MFA bombing exploits human frustration by flooding approval prompts until a user finally taps accept.
- The technique is effectively a denial-of-service against a user's attention, increasing the chance of a mistaken approval.
Scammers Used Real Apple Support Workflow To Lend Credibility
- Attackers phoned using Apple's real support workflow to generate authentic case ID emails that landed in Matt's inbox.
- The SMS link led to audit-apple[...] domain and a convincing fake page with the real case ID and fake chat transcript.
Pixel Perfect Phishing Is Cheap And Effective
- Pixel-perfect phishing sites are trivial to create using open-source tools and can perfectly mimic legitimate sites.
- The only technical difference is where submitted credentials are sent, making detection hard for victims.