#Xcode life scam code#

That’s how Mac users end up infected with things like malware, adware, and unethical junk software.

Unlike on iOS, Mac users can download apps from anywhere, and frequently do. Of course, there are many other cases where the App Store screening process wouldn’t come into play, and that could be equally convincing, if not more so.įor example, consider macOS instead of iOS.

#Xcode life scam code#

Not only would the hacker have to sneak this code past the review, they’d also have to create a decoy app that would be compelling enough to download-something that is increasingly difficult even for legitimate developers in the crowded iOS App Store. iOS apps can only be downloaded through the App Store, and although I would never say that it’s impossible to get a phishing app into the App Store, it certainly would not be an easy thing to do. However, I don’t see this particular phish as a huge risk. Looking at Krause’s example above, I have to admit that this is something I might fall victim to, although I might wonder why the request was showing up within the context of a third-party app. In the case of Krause’s iOS phishing scam, by using simple code any app could easily simulate a standard iOS password request, and most users wouldn’t think anything was amiss. This got us thinking about the ramifications-how else could this tactic be used in the Apple ecosystem, and what kind of damage could it do?

In a recent blog post, Felix Krause revealed a method for phishing Apple ID passwords on iOS that would be quite indistinguishable from a real iOS password request.