Two Apple iCloud mail vulnerabilities let attackers send forged icloud.com emails that looked authentic to receiving systems. The bugs stemmed from inconsistent parsing in two parts of Apple’s outbound mail pipeline, allowing a forged From header to bypass sender checks; the first was reported in May 2024, Apple’s initial fix was incomplete, and the issues were not fully resolved until December 2025. Apple paid a $15,000 bug bounty.
Why it matters: This matters because people and organizations often trust messages that pass standard anti-spoofing checks, making phishing and impersonation more convincing. Defenders should treat historic icloud.com-origin trust assumptions cautiously and review mail-security detections for similar parser inconsistencies.
SecurityWeek News
2026.10.02
100% relevant
This article is the anchor disclosure describing the underlying iCloud spoofing flaw, its cause, and the timeline showing Apple’s initial remediation was incomplete.
← Back to all stories