Emails which appear to come from Apple email servers may be carefully crafted spam. Scammers have found a way to abuse Apple's calendar tools to disguise the spam and bypass filters.

The spam is getting to many more recipients than usual as the messages appear to come from the user noreply[@]email.apple.com. It appears to be convincing enough that some spam filter systems are treating it as coming from a legitimate source within Apple, which is clearly not something most people would want blocked.

The trick behind the spam is that the original message isn't sent as a standard email. Instead it's technically an event invite created and sent in Apple's iCloud calendar tool. The invite is sent to a mailing list that is set to redirect messages to a huge number of people.

Microsoft Exploited

The scam works because the mailing list uses a Microsoft 365 account for the supposed sender, a tactic which exploits a technical measure that makes email forwarding less problematic. (Source: bleepingcomputer.com)

The outcome is somewhat complicated, but in very simple terms Microsoft thinks everything is legitimate because Microsoft appears to be the sender, while everyone else thinks it's legitimate because it comes from Apple.

The invite is crafted to look like a normal email message, with the most common version of the scam being a bogus payment receipt that supposedly involves money being taken out of the recipient's PayPal account for a purchase they never made.

"Call Back" Scam

The message includes a phone number to call if the payment is incorrect. That's actually a way to get the victim on the phone, most likely to trick them into allowing remote access to their computer to Indian scammers, supposedly to install software either to "initiate a refund" or fix supposed account hacking. Such scams are known as a "call-back phishing" campaign.

Creative as the specific tactics for distributing the message are, the core of the scam is extremely familiar. While spam filtering can reduce the number of scam messages people receive, it's still important to watch out for suspicious signs such as unsolicited messages creating a sense of urgency or asking people to click a link or call a number. (Source: malwarebytes.com)

What's Your Opinion?

Have you spotted any of these emails? How good is your email provider at filtering out spam? Have you ever received a suspicious email that turned out to be legitimate?