Phishers Steal Storage on Apple iDisk

Symantec has found an interesting phish which seeks to steal a users's MobileMe credentials using a spoofed iDisk page.

Apple's MobileMe is a subscription service containing a number of features including iDisk, a web-based storage service. ("MobileMe" as such is being retired in favor of the new iCloud service.)


The phish comes via e-mail which contains a link to the phishing page. The phishing page displays the user's MobileMe userid and asks for the password. How do they get the userid? They guess at it based on the username in the e-mail of the phish. So if the phishing e-mail is being sent to '', they would guess the MobileMe userid to be 'foobar'.

This is far from a foolproof method, but it doesn't have to be perfect. It's another example of how you have to be careful of what you click on, especially when solicited by e-mail. Furthermore, in this case, it's completely cross-platform.

blog comments powered by Disqus