Loading story…
Brave Browser 1.94 introduces Email Aliases, allowing desktop users to register with unique disposable forwarding addresses rather than disclose their primary email address. The aliases are intended to impede identity matching by websites, advertisers, and data brokers, while reducing spam and phishing exposure following breaches; users can deactivate and replace an alias that begins receiving unwanted mail.
The feature requires a free Brave Account and currently provides up to five aliases, with mobile support and a higher-limit Premium tier planned. Brave says aliases and primary addresses are encrypted at rest, account authentication uses the OPAQUE password-authenticated key-exchange protocol standardized as RFC 9807, forwarded messages undergo spam and malware filtering, and delivered messages are removed from its servers within seconds.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Brave introduced Email Aliases in desktop version 1.94, allowing users to generate unique forwarding addresses rather than provide their primary email address to websites. The initial free offering supports up to five aliases and is intended to limit cross-service identity matching, spam, and phishing exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcebrave.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has reversed a planned change to its iCloud+ **Hide My Email** feature and will keep masked addresses on the `@icloud.com` domain instead of moving them to `@private.icloud.com`. The company changed course after users warned that the new domain would make disposable aliases easier for websites and apps to identify and potentially block during account creation, weakening one of the feature’s core privacy benefits. Apple said it made the decision after reviewing community feedback. The reversal applies to Hide My Email aliases, which generate disposable forwarding addresses for iCloud+ users, but Apple still plans to migrate **Sign in with Apple** relay addresses from `@privaterelay.appleid.com` to `@private.icloud.com` later in 2026. Developers have been told to allow the new domain, while older relay addresses will continue forwarding without interruption. Reporting also noted that although Hide My Email obscures a user’s real address from services, Apple can still identify the account behind an alias for law-enforcement requests, and the feature previously faced scrutiny over a bug that exposed real email addresses in some spam-rejection scenarios before Apple fixed it.
Aug 25, 2026
A reported vulnerability in Apple’s iCloud+ **Hide My Email** service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher **Tyler Murphy** of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that **404 Media** independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services. Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the `@private.icloud.com` domain could make Hide My Email aliases easier for websites and apps to identify and block.
Jul 9, 2026
Apple patched a vulnerability in **Hide My Email** that could reveal users’ real email addresses when messages sent to an alias were rejected as spam, exposing the underlying address in email logs. Researcher Tyler Murphy of EasyOptOut reported the issue to Apple in June 2025, but reports say the company did not fully remediate it until July 3, 2026, after public coverage highlighted that the flaw remained exploitable despite an earlier claim that it had been fixed. Limited testing by the researcher indicated that all tested Hide My Email aliases were vulnerable, and users who created addresses before **July 7, 2026** may still face exposure through retained third-party mail logs generated before the patch. The incident has triggered a proposed class action lawsuit accusing Apple of false advertising and consumer protection violations, with plaintiffs seeking reimbursement of subscription costs and an injunction related to the service.
Jul 23, 2026