Loading story…
Security researchers Talal Haj Bakry and Tommy Mysk disclosed that Apple’s iCloud Private Relay can be bypassed, allowing websites to learn a user’s real IP address even when Safari’s privacy feature is enabled. The researchers said the leak stems from multiple WebKit behaviors, including WebAuthn flows tied to passkeys, DNS prefetching in iOS 26, and WebTransport in iOS 26.4. Because the issue is rooted in WebKit, the exposure can also affect some third-party browsers on iOS, not just Safari.
The researchers published a blog post and a public test site demonstrating that sites using or even imitating passkey-related prompts can trigger network requests outside Private Relay’s proxied path, exposing the device’s actual IP address and, in some cases, real DNS infrastructure without obvious user interaction. TechCrunch said it verified the leak during testing, while Apple told another outlet it is investigating the report; Private Relay remains an opt-in feature for iCloud+ subscribers and protects Safari traffic rather than providing system-wide coverage like a VPN.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
After the researchers' findings were reported, Apple told 404 Media that it is investigating the report about iCloud Private Relay leaking users' real IP addresses. Separate coverage also noted Apple had not responded to another request for comment at the time of publication.
Security researchers Tommy Mysk and Talal Haj Bakry disclosed that Apple's iCloud Private Relay can be bypassed to reveal a user's real IP address, and they published a website for users to test whether their IP leaks. They said the issue stems from WebKit behavior, including WebAuthn-related requests, with additional leakage paths involving DNS prefetching in iOS 26 and WebTransport in iOS 26.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemacrumors.com
Open sourcetechcrunch.com
Open source404media.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A reported vulnerability in Apple’s iCloud+ **Hide My Email** service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher **Tyler Murphy** of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that **404 Media** independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services. Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the `@private.icloud.com` domain could make Hide My Email aliases easier for websites and apps to identify and block.
Jul 9, 2026
Apple said new anonymous relay addresses created through **iCloud+ Hide My Email** and **Sign in with Apple** will use the shared domain `private.icloud.com`, replacing the current split between `privaterelay.appleid.com` and `icloud.com` for newly generated addresses. The company said the change will roll out later this summer, while existing relay addresses on the legacy domains will continue to function without interruption. Apple told developers, app operators, and email service providers to update validation logic, allowlists, filtering, suppression lists, and routing rules so messages sent to `private.icloud.com` are accepted alongside the older domains. The change has drawn criticism from some users, who argue that a distinct relay domain could make Hide My Email addresses easier for websites and apps to detect and potentially block, weakening the privacy feature’s usefulness for anonymous sign-ups.
Jun 29, 2026
Apple is facing a proposed class action lawsuit alleging that its **Hide My Email** feature exposed users’ real email addresses to websites and apps despite being marketed as a privacy protection. The complaint says the flaw allowed aliases generated through iCloud+ to be linked back to a user’s actual address, potentially defeating the purpose of the service and raising claims under California false advertising and consumer protection laws. According to the filings, a security researcher reported the issue to Apple in June 2025, Apple acknowledged it the following month, later said in March that it had addressed the problem, and then indicated in May that a patch would be released within weeks, but the lawsuit alleges the vulnerability remained unresolved. The suit seeks compensation for iCloud+ subscribers and other users who paid for privacy protections that allegedly did not work as advertised, while reports say there are **no known cases of active exploitation** and technical reproduction details have not been publicly disclosed.
Jul 18, 2026