ICloud Calendar callback phishing campaign
Campaign
Summary
Hide ▲
Show ▼
A callback phishing campaign is abusing iCloud Calendar and Apple's email servers to send fake purchase-notification emails that are more likely to bypass spam filters and reach inboxes. The lure impersonates a $599 PayPal charge and pushes recipients to call a scam phone number. The abuse of a trusted Apple delivery path increases delivery success and credibility.
Related Happenings
FakeWallet Apple App Store wallet-stealing apps
Malware Activity
H score8
First: 21.04.2026 00:52
Last: 21.04.2026 00:52
Sources 1
About this happening:
The FakeWallet app set turned the Apple App Store into a delivery channel for 26 malicious wallet lookalikes, putting crypto holders at risk of account takeover and th...
FakeWallet Apple App Store wallet-stealing apps
Malware ActivityAbout this happening: The FakeWallet app set turned the Apple App Store into a delivery channel for 26 malicious wallet lookalikes, putting crypto holders at risk of account takeover and th...
Apple account change notification phishing campaign
Campaign
H score30
First: 19.04.2026 19:03
Last: 19.04.2026 19:03
Sources 1
About this happening:
A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authen...
Apple account change notification phishing campaign
CampaignAbout this happening: A callback phishing campaign is abusing Apple account change notifications to deliver fake iPhone purchase scams through legitimate emails, making the lure look authen...
W3LL Microsoft 365 adversary-in-the-middle phishing campaign
Campaign
H score39
First: 13.04.2026 21:55
Last: 13.04.2026 21:55
Sources 1
About this happening:
The W3LL phishing operation turned into a high-volume Microsoft 365 credential-theft campaign, exposing more than 17,000 victims worldwide to BEC risk. The kit use...
W3LL Microsoft 365 adversary-in-the-middle phishing campaign
CampaignAbout this happening: The W3LL phishing operation turned into a high-volume Microsoft 365 credential-theft campaign, exposing more than 17,000 victims worldwide to BEC risk. The kit use...
EvilTokens phishing-as-a-service operation expands device code phishing and BEC
Threat Actor Meta
H score44
First: 01.04.2026 22:42
Last: 01.04.2026 22:42
Sources 1
About this happening:
EvilTokens is part of a broader phishing-as-a-service ecosystem that packages Microsoft 365 device-code phishing for criminal operators. Cisco Talos described AR...
EvilTokens phishing-as-a-service operation expands device code phishing and BEC
Threat Actor MetaAbout this happening: EvilTokens is part of a broader phishing-as-a-service ecosystem that packages Microsoft 365 device-code phishing for criminal operators. Cisco Talos described AR...
Microsoft Azure Monitor callback phishing campaign
Campaign
H score29
First: 21.03.2026 16:09
Last: 21.03.2026 16:09
Sources 1
About this happening:
A callback phishing campaign is abusing Microsoft Azure Monitor alerts to send fake billing warnings through legitimate Microsoft mail flow, making the messages more belie...
Microsoft Azure Monitor callback phishing campaign
CampaignAbout this happening: A callback phishing campaign is abusing Microsoft Azure Monitor alerts to send fake billing warnings through legitimate Microsoft mail flow, making the messages more belie...
Timeline
-
07.09.2025 20:10 2 articles · 10mo ago
iCloud Calendar invites send callback phishing emails from Apple’s servers
Initial DisclosureA callback phishing campaign abuses iCloud Calendar invites to send fake PayPal purchase notifications from [email protected] and email.apple.com, with the lure text hidden in the Notes field and the invite sent to a Microsoft 365 address that can forward the message to downstream targets. The delivery path helps the email pass SPF, DMARC, and DKIM checks and may let it bypass spam filters, increasing the chance that recipients call the scammer’s support number.
Show sources
- iCloud Calendar abused to send phishing emails from Apple’s servers — www.bleepingcomputer.com — 07.09.2025 20:10
- iCloud Calendar abused to send phishing emails from Apple’s servers — www.bleepingcomputer.com — 07.09.2025 20:10