New Phishing Campaign Targeted at Mac Users

Topic

New Reply

https://layerxsecurity.com/blog/layerx-identifies-new-phishing-campaign-targeted-at-mac-users/

..For the past few months, LayerX has been monitoring a sophisticated phishing campaign that initially targeted Windows users by masquerading as Microsoft security alerts. The campaign’s goal was to steal user credentials by employing deceptive tactics that made victims believe their computers were compromised.

Now, with new security features rolled out by Microsoft, Chrome, and Firefox, the attackers have shifted their focus to Mac users…

Reply | Quote

Replies

@alex5723 I assume if or when you might get this fake alert, your Mac is in fact not “locked” but is still working properly?

iPhone 13, 2019 iMac(SSD)

Reply | Quote

pmcjr6142 wrote:

your Mac is in fact not “locked”

The original phishing attack involved compromised websites displaying fake security warnings

Looks more like clickbait to me with headlines like this:

LayerX Labs Identifies New Zero-Hour Phishing Attack

Phishing attacks are never zero hour/day, they are real time in email or via a website and rely on you panicking instead of taking a measured approach.
Zero day implies you are at risk now because a fix has not yet been released, which is not the case for phishing.

cheers, Paul

1 user thanked author for this post.

pmcjr6142

Reply | Quote

Paul T wrote:

Looks more like clickbait to me with headlines like this:

LayerX Labs Identifies New Zero-Hour Phishing Attack

Phishing attacks are never zero hour/day, they are real time in email or via a website and rely on you panicking instead of taking a measured approach.

Zero-hour refers to the frequent rotation of randomized subdomains for phishing sites, as explained below that headline:

Why Conventional Defenses Failed

2. Zero-Hour Randomized Subdomains

The attackers made use of randomized subdomains to avoid detection. LayerX labs captured “pushalm83e.z13.web.core.windows[.]net”. However, these domain strings can be easily generated and frequently rotated.

This allows attackers to ensure that the page would not match any existing threat intelligence or URL blacklists in place. This tactic, often referred to as a “zero-hour” technique, allows phishing sites to stay online just long enough to trap victims before they are taken down and rotated to another randomized subdomain.

LayerX Labs Identifies New Zero-Hour Phishing Attack

Recent cybersecurity data reveals an alarming 130% surge in zero-hour phishing attacks targeting previously unknown browser vulnerabilities.

These sophisticated attacks leverage unpatched security flaws in popular browsers to deploy malicious payloads before security teams can implement countermeasures, leaving users and organizations extremely vulnerable in the critical first hours of an attack campaign.

Zero-Hour Phishing Attacks Exploiting Browser Vulnerabilities Increases by 130% [March 20, 2025]

1 user thanked author for this post.

Alex5723

Reply | Quote

pmcjr6142 wrote:

I assume if or when you might get this fake alert, your Mac is in fact not “locked” but is still working properly?

The browser becomes inoperable (sometimes on full screen):

… malicious code caused the webpage to freeze, creating the illusion that the entire computer was locked.

Microsoft Edge users can hold the ESC key to exit full screen (even on MacOS):

Users can always close a full screen scareware page by PRESSING AND HOLDING the ESC key.

Anatomy of a scareware scam

4 users thanked author for this post.

Elly, satrow, Alex5723, pmcjr6142

Reply | Quote