Loading story…
SEC Consult researcher Timo Longin disclosed two flaws in Apple iCloud Mail's outbound SMTP processing that allowed a holder of a free iCloud account to send email impersonating arbitrary @icloud.com addresses. The issues abused inconsistent parsing of message fields, including unusual carriage-return characters in the From header and differing handling of SMTP dot-stuffing. Messages were relayed through legitimate Apple infrastructure, allowing them to pass SPF, DKIM, and DMARC checks and appear authenticated to recipients.
SEC Consult initially reported one flaw to Apple on May 21, 2024, then found a bypass after Apple altered handling of the original proof of concept. Apple confirmed final remediation in December 2025 and awarded Longin a $15,000 Apple Security Bounty; SEC Consult published the technical details on October 1, 2026. The flaws could have enabled highly convincing phishing or business-email-compromise messages that evaded common email-authentication defenses.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
SEC Consult published its technical report describing two iCloud Mail SMTP-processing flaws that let free iCloud accounts send authenticated-looking email as arbitrary @icloud.com identities.
Apple confirmed that both iCloud Mail email-spoofing issues had been finally remediated.
Timo Longin of SEC Consult reported a carriage-return parsing flaw in Apple iCloud Mail that could bypass sender-address validation and enable arbitrary @icloud.com sender spoofing.
Apple awarded Timo Longin a $15,000 Apple Security Bounty for the iCloud Mail spoofing findings.
After Apple changed its handling of the original proof of concept, SEC Consult identified another bypass based on inconsistent SMTP dot-stuffing parsing. It likewise enabled unauthorized @icloud.com sender impersonation through Apple infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A reported vulnerability in Apple’s iCloud+ **Hide My Email** service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher **Tyler Murphy** of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that **404 Media** independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services. Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the `@private.icloud.com` domain could make Hide My Email aliases easier for websites and apps to identify and block.
Jul 9, 2026
Apple patched a vulnerability in **Hide My Email** that could reveal users’ real email addresses when messages sent to an alias were rejected as spam, exposing the underlying address in email logs. Researcher Tyler Murphy of EasyOptOut reported the issue to Apple in June 2025, but reports say the company did not fully remediate it until July 3, 2026, after public coverage highlighted that the flaw remained exploitable despite an earlier claim that it had been fixed. Limited testing by the researcher indicated that all tested Hide My Email aliases were vulnerable, and users who created addresses before **July 7, 2026** may still face exposure through retained third-party mail logs generated before the patch. The incident has triggered a proposed class action lawsuit accusing Apple of false advertising and consumer protection violations, with plaintiffs seeking reimbursement of subscription costs and an injunction related to the service.
Jul 23, 2026
Apple is facing a proposed class action lawsuit alleging that its **Hide My Email** feature exposed users’ real email addresses to websites and apps despite being marketed as a privacy protection. The complaint says the flaw allowed aliases generated through iCloud+ to be linked back to a user’s actual address, potentially defeating the purpose of the service and raising claims under California false advertising and consumer protection laws. According to the filings, a security researcher reported the issue to Apple in June 2025, Apple acknowledged it the following month, later said in March that it had addressed the problem, and then indicated in May that a patch would be released within weeks, but the lawsuit alleges the vulnerability remained unresolved. The suit seeks compensation for iCloud+ subscribers and other users who paid for privacy protections that allegedly did not work as advertised, while reports say there are **no known cases of active exploitation** and technical reproduction details have not been publicly disclosed.
Jul 18, 2026