{"id":66668,"date":"2026-04-14T00:29:29","date_gmt":"2026-04-13T22:29:29","guid":{"rendered":"https:\/\/www.apfelpatient.de\/?p=66668"},"modified":"2026-04-14T00:31:43","modified_gmt":"2026-04-13T22:31:43","slug":"icloud-backups-hacked-via-fake-apple-sites","status":"publish","type":"post","link":"https:\/\/www.apfelpatient.de\/en\/news\/icloud-backups-ueber-gefaelschte-apple-seiten-gehackt","title":{"rendered":"Hackers are attacking iCloud backups via fake Apple websites"},"content":{"rendered":"

A years-long hack-for-hire campaign has specifically targeted the iCloud backups of journalists, activists, and government officials. The attackers used fake Apple websites to steal Apple ID credentials.<\/strong><\/p>\n\n\n\n

While the security debate surrounding Apple has recently focused on technically complex exploits like Coruna and DarkSword, a new study shows that well-known methods remain alarmingly effective. Three cybersecurity organizations\u2014 Access Now<\/a>, Lookout<\/a>, and SMEX<\/a> - have documented a coordinated hack-for-hire campaign that targeted individuals in the Middle East, North Africa, and beyond between 2023 and 2025. At the heart of the attacks on iPhone users were phishing sites that deceptively mimicked Apple's login pages.<\/p>\n\n\n\n

The campaign was attributed to the group BITTER APT, which, according to Lookout, is an offshoot of the Indian hack-for-hire company Appin. Unlike the recently uncovered exploit chains that took advantage of technical vulnerabilities in iOS, BITTER APT relied on social engineering: The attackers tricked their targets into entering their Apple ID credentials on fake websites. With this data, they could then access the victims' iCloud backups\u2014and thus the entire contents of their iPhones.<\/p>\n\n\n\n

Nearly 1,500 fake domains<\/h2>\n\n\n\n

Lookout identified nearly 1,500 different web addresses in its report that served as phishing infrastructure. These included numerous domains that specifically imitated Apple services \u2013 such as variations like "facetime-web.me-en.io", "apple.id-us.cc", and "icloud.com-service.info". The fake pages were designed to be virtually indistinguishable from genuine Apple login pages.<\/p>\n\n\n\n

The campaign wasn't limited to Apple: Google, Microsoft, Signal, WhatsApp, and Yahoo were also used as templates for phishing sites. The attackers adapted their methods depending on the platform and target audience.<\/p>\n\n\n\n

Governments outsource hacking<\/h2>\n\n\n\n

The investigation confirms a growing trend: government agencies are contracting private hack-for-hire companies to conduct surveillance operations. This offers two advantages for the clients: the hacking group operates the entire infrastructure, providing the client with plausible deniability. At the same time, hiring such groups is significantly cheaper than purchasing commercial spyware like Pegasus.<\/p>\n\n\n\n

The documented targets included journalists, civil society actors, and government officials in several countries in the Middle East and North Africa, as well as in Great Britain. Individuals with connections to US universities were also affected.<\/p>\n\n\n\n