A malicious campaign has been discovered targeting Macseeking support or extended warranty services through AppleCare+.
This scam involves perpetrators purchasing ads on Google in order to lure victims to malicious websites hosted on GitHub, a platform owned by Microsoft.
The goal is to connect unsuspecting users with hackers posing as Apple representatives, using social engineering to extort money from them.
Read also: Apple: Confirms that the entire iPhone 16 series will have 8 GB of RAM
How does Fraud work?
The scam begins when users search for Apple online support. Google, which is rumored to have paid Apple $20 billion to be the default search engine, displays search results in Safari, including ads.
These “Sponsored” results can be very prominent, sometimes even appearing above Apple’s official contact information. In some cases, multiple malicious ads are displayed before any genuine results.
Users who click on these deceptive ads are redirected to a fake AppleCare+ customer service page. This page invites users to call a toll-free number, which supposedly belongs to Apple.
However, victims are quickly connected to hackers operating from overseas call centers. The fake AppleCare+ customer service pages are hosted on GitHub as standalone HTML templates that use Apple branding, making them appear legitimate.
See also: Apple fixes "GAZEploit" vulnerability in Vision Pro
GitHub: An exploitable platform
Hackers have created a multitude of GitHub accounts, each hosting repositories with fake templates. These templates mimic Apple's branding, aiming to deceive users.
As evidenced by GitHub 's commit history , hackers can easily swap phone numbers during active campaigns if someone is reported and blocked.
A fascinating piece of code on these pages, known as “auto Dial,” automatically opens the phone’s dialog menu, reducing the number of clicks required for victims to connect with hackers, who impersonate Apple representatives.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
GitHub has responded to this issue by removing the reported malicious accounts. However, the ease with which hackers can create new accounts and templates is an ongoing challenge.
Risks and consequences for victims
According to reports from Malwarebytes, this scam is particularly dangerous due to the combination of malicious Google ads and convincing lookalike pages. Hackers exploit users' trust in the Apple brand, making them believe they are interacting with legitimate service representatives.
Read more: Apple is officially retiring these three iPhones
The financial risks are serious, as victims can be scammed out of hundreds or even thousands of dollars. Often, hackers instruct victims to withdraw money from their bank accounts and send it via various methods.
In some cases, hackers ask for sensitive personal information, such as the victim's name, address, social security number, and banking information. This information allows hackers to engage in further malicious activities, such as identity theft or extortion.
Source: cybersecuritynews
