Stealing your Apple ID and iPhone password is not a difficult task despite Apple's obsession with security as it only takes 30 lines of code to complete the first step of a phishing attack .
Essentially, according to developer Felix Krause, it only takes a few minutes to recreate an Apple ID password that appears on iOS devices, making it easy to phish and steal credentials from an iPhone or iPad.
The developer explained that the malicious code could be placed in legitimate iOS apps that would allow the attacker to bypass the App Store's security shield and reach thousands of devices.
"A dialog box is presented that looks exactly like a system pop-up window. Therefore, the user can be very easily fooled," he explained, without publishing the code to recreate the window because he is currently working on solving the problem in collaboration with Apple.
The pop-up dialog box requesting credentials may require further information including the 2-step verification code if this application is enabled in the specific software.
This essentially means that no software is safe unless Apple blocks all attempts outside of the App Store and Settings. In reality, this is one way users can protect themselves from phishing scams until the company comes up with a solution.
The developer recommends that users press the home button on their phone to check if the app closes. If it does close and the password prompt disappears, then it is most likely a phishing attack. You can avoid entering credentials in such pop-ups by going to settings and entering your password there.
