Loading story…
Apple introduced Impersonation Risk Detection in iOS 27 and iPadOS 27, an opt-in privacy feature that helps participating apps identify actions potentially tied to active social-engineering or impersonation scams. The operating system assesses device-use, Apple Account, interaction, timing, contextual, and limited sensor-data signals locally, while excluding the contents of Photos, Messages, and Mail.
Supported apps receive only an unknown, medium, or high risk assessment rather than the underlying data. Developers can use that result to display warnings, delay sensitive transactions, or require identity verification before actions such as account-security changes or large payments. Users can control global and per-app access in Privacy & Security settings, though setting changes may take up to 24 hours to take effect; effectiveness depends on both user opt-in and app adoption.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Apple introduced an opt-in, on-device feature enabling supported apps to request risk assessments for security-sensitive actions that may be associated with social-engineering impersonation scams. Apps receive only an unknown, medium, or high risk level and can independently warn users, require verification, or delay an action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple users are being targeted in a social engineering campaign that uses unexpected **FaceTime** calls to impersonate banks and Apple Support, with attackers aiming to steal money and take over accounts. Reports say the scam often starts with urgent text messages claiming there is a problem with a bank or Apple account, then escalates to unsolicited video calls in which fraudsters pressure victims to reveal banking details, **Apple ID** credentials, and **MFA** codes, or to install remote-access software. Security reporting says the tactic exploits the trust created by real-time video interactions to reduce suspicion and speed compliance, enabling account takeover and financial theft. The campaign may also be paired with browser-side flaws and other multi-stage techniques to deepen compromise after credentials are stolen. Apple and financial institutions do not use FaceTime for urgent security remediation, and users are being urged to verify any alerts through official channels, keep **iOS** and **iPadOS** updated, and report suspected scams to Apple.
Jul 17, 2026
Apple unveiled an **Apple Intelligence** feature for `iOS 27` that can automatically change passwords for compromised or weak accounts in Safari and the Apple Passwords app. Instead of only warning users that a credential is weak, duplicated, or exposed in a breach, the new capability can take users directly through remediation by generating a strong replacement password and saving it to their password vault. Apple said the feature is designed with a privacy-first architecture that combines on-device processing with **Private Cloud Compute**. When a user reviews compromised credentials, they can tap a single **Fix** option and Safari will handle the reset flow on supported sites by signing in, navigating to the password-change page, creating a unique high-entropy password, and storing it automatically, with progress surfaced through **Live Activities** in Notification Center. Apple positioned the feature as a way to address the common problem of users ignoring breach alerts, helping reduce password reuse and lowering the risk of credential-stuffing attacks when the update ships later this year.
Jun 29, 2026
Apple is testing a new iMessage security alert in iOS 26.6 that warns users when a message may be malicious or pose a risk to device security or privacy. The feature, labeled **“Malicious Message Detected,”** appears in iOS 26.6 beta 5 and gives users the option to dismiss the warning or share the suspicious message with Apple to support investigation and improve future protections. The warning appears aimed at threats such as phishing, spyware delivery, and potentially more sophisticated iMessage exploitation, although Apple has not disclosed how messages are classified or confirmed whether the feature will ship in the public release. The addition builds on existing Messages defenses including **BlastDoor**, **Lockdown Mode**, **iMessage Contact Key Verification**, and spam filtering, and follows years of scrutiny over advanced iMessage attacks, including past zero-click exploits that bypassed earlier safeguards.
Jul 15, 2026