Loading story…
Apple added Impersonation Risk Detection to iOS 27 and iPadOS 27 to help participating applications identify potential social-engineering and identity-impersonation scams before sensitive actions. Apps can request an assessment for events such as payments, password changes, or sharing account details, and receive an Unknown, Medium, or High risk rating; each developer decides whether to warn the user, require additional identity verification, delay the action, or apply other controls.
The capability is disabled by default and requires users to enable Share with App Developers; activation can take up to 24 hours. Apple says its assessment uses relevant Apple Account and device signals while Apple neither receives the underlying interaction-assessment data nor inspects content in Mail, Messages, or Photos, although it can learn the action category for which an app requests a risk assessment.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Apple introduced Impersonation Risk Detection to help supported Apple and third-party apps identify potential social-engineering and impersonation scams before sensitive actions such as payments, password changes, or sharing account information. The feature returns Unknown, Medium, or High risk assessments, while participating apps determine the resulting safeguards.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple introduced **Impersonation Risk Detection** in iOS 27 and iPadOS 27, an opt-in privacy feature that helps participating apps identify actions potentially tied to active social-engineering or impersonation scams. The operating system assesses device-use, Apple Account, interaction, timing, contextual, and limited sensor-data signals locally, while excluding the contents of Photos, Messages, and Mail. Supported apps receive only an `unknown`, `medium`, or `high` risk assessment rather than the underlying data. Developers can use that result to display warnings, delay sensitive transactions, or require identity verification before actions such as account-security changes or large payments. Users can control global and per-app access in Privacy & Security settings, though setting changes may take up to 24 hours to take effect; effectiveness depends on both user opt-in and app adoption.
Sep 24, 2026
Apple is testing a new iMessage security alert in iOS 26.6 that warns users when a message may be malicious or pose a risk to device security or privacy. The feature, labeled **“Malicious Message Detected,”** appears in iOS 26.6 beta 5 and gives users the option to dismiss the warning or share the suspicious message with Apple to support investigation and improve future protections. The warning appears aimed at threats such as phishing, spyware delivery, and potentially more sophisticated iMessage exploitation, although Apple has not disclosed how messages are classified or confirmed whether the feature will ship in the public release. The addition builds on existing Messages defenses including **BlastDoor**, **Lockdown Mode**, **iMessage Contact Key Verification**, and spam filtering, and follows years of scrutiny over advanced iMessage attacks, including past zero-click exploits that bypassed earlier safeguards.
Jul 15, 2026
Apple users are being targeted in a social engineering campaign that uses unexpected **FaceTime** calls to impersonate banks and Apple Support, with attackers aiming to steal money and take over accounts. Reports say the scam often starts with urgent text messages claiming there is a problem with a bank or Apple account, then escalates to unsolicited video calls in which fraudsters pressure victims to reveal banking details, **Apple ID** credentials, and **MFA** codes, or to install remote-access software. Security reporting says the tactic exploits the trust created by real-time video interactions to reduce suspicion and speed compliance, enabling account takeover and financial theft. The campaign may also be paired with browser-side flaws and other multi-stage techniques to deepen compromise after credentials are stolen. Apple and financial institutions do not use FaceTime for urgent security remediation, and users are being urged to verify any alerts through official channels, keep **iOS** and **iPadOS** updated, and report suspected scams to Apple.
Jul 17, 2026