iCloud backups hacked via fake Apple websites Apfelpatient

A years-long hack-for-hire campaign has specifically targeted the iCloud backups of journalists, activists, and government officials. The attackers used fake Apple websites to steal Apple ID credentials.

While the security debate surrounding Apple has recently focused on technically complex exploits like Coruna and DarkSword, a new study shows that well-known methods remain alarmingly effective. Three cybersecurity organizations— Access Now, Lookout, and SMEX - have documented a coordinated hack-for-hire campaign that targeted individuals in the Middle East, North Africa, and beyond between 2023 and 2025. At the heart of the attacks on iPhone users were phishing sites that deceptively mimicked Apple's login pages.

The campaign was attributed to the group BITTER APT, which, according to Lookout, is an offshoot of the Indian hack-for-hire company Appin. Unlike the recently uncovered exploit chains that took advantage of technical vulnerabilities in iOS, BITTER APT relied on social engineering: The attackers tricked their targets into entering their Apple ID credentials on fake websites. With this data, they could then access the victims' iCloud backups—and thus the entire contents of their iPhones.

Nearly 1,500 fake domains

In its report, Lookout identified nearly 1,500 different web addresses serving as phishing infrastructure. These included numerous domains that specifically imitated Apple services – such as variations like „facetime-web.me-en.io”, „apple.id-us.cc”, and „icloud.com-service.info”. The fake pages were designed to be virtually indistinguishable from genuine Apple login pages.

The campaign wasn't limited to Apple: Google, Microsoft, Signal, WhatsApp, and Yahoo were also used as templates for phishing sites. The attackers adapted their methods depending on the platform and target audience.

Governments outsource hacking

The investigation confirms a growing trend: government agencies are contracting private hack-for-hire companies to conduct surveillance operations. This offers two advantages for the clients: the hacking group operates the entire infrastructure, providing the client with plausible deniability. At the same time, hiring such groups is significantly cheaper than purchasing commercial spyware like Pegasus.

The documented targets included journalists, civil society actors, and government officials in several countries in the Middle East and North Africa, as well as in Great Britain. Individuals with connections to US universities were also affected.

What iPhone users can do

This case underscores that technical security measures are only as strong as their weakest link – and that is often the human element. Apple's anti-theft features and encryption technologies do not protect against phishing if users voluntarily enter their login credentials on a fake website.

The most important protective measures: Enable two-factor authentication for your Apple ID (if you haven't already), be generally suspicious of links in emails and messages, and never enter your Apple ID credentials on websites that are not directly accessible via apple.com. Apple's hardware security key support offers additional protection for particularly vulnerable individuals.

Anyone who suspects they have been the target of such an attack should immediately change their Apple ID password and check which devices are linked to their account – via “Settings” > their name > “Devices”. (Image: Shutterstock / FamVeld)