Cyber threat alert: Beware of fake Apple websites ahead of iPhone Air, 17 series sale

Cybercriminals have set up fake online marketplaces. To attract naive users, they will offer big cash discounts compared to the genuine e-commerce firms.

Last week, Apple unveiled the all-new iPhone Air along with iPhone 17, 17 Pro series, AirPods Pro 3, Watch Series 11, Watch Ultra 3 and SE 3 smart wearables at Cupertino, US.

All the new Apple devices are set to hit stores worldwide on Friday (September 19). They will also be available on the official Apple Store, mobile apps, and partner e-commerce sites such as Amazon, Flipkart, Blinkit, Croma, and more in India.

However, prospective buyers are advised to be wary of websites offering new Apple devices, as cybercriminals set up fake online marketplaces. To attract naive users, they will offer big cash discounts compared to the genuine e-commerce firms.

They will be too irresistible to ignore, but if they fall prey to the bait, they may lose their hard-earned money, reports Kaskersky, a popular cybersecurity solution provider.

"Cybercriminals thrive on the excitement of major product launches, turning consumer enthusiasm into a gateway for data breaches. We've seen these tactics evolve from crude phishing to highly polished sites that can look authentic. Users must prioritise verification over impulse to stay safe and avoid falling victim to these opportunistic threats,” said Tatyana Shcherbakova, Web Content Analyst at Kaspersky.

Fake iPhone sale webpage.

Devious ways to harvest data

Threat actors build benign-looking websites with Apple logos and typefaces, offering steep discounts on new Apple products.

Unfortunately, many fall for such flashy websites, and they never know that this particular online marketplace is compromised and contains malicious code to harvest victims' personal and financial details.

After the user puts a device in the cart, he/she will be directed to a new webpage and shown a form to fill in the financial details such as debit/credit card details, CVV (Card Verification Value) number, phone number, email IDs and other personal identifiable details.

If not careful enough, they will call the victim and ask them to type -- ' 21*[destination number]# '. If he/she does that, all the calls and messages will be forwarded to the criminal's phone number. This way, when they transfer the money from the victim's account to their accounts, OTPs and cash debit messages get sent to the criminal's phone.

And, before the victim comes to terms with what just happened, threat actors would have cleaned the bank account and funnelled the stolen money to their accounts.

It will be very difficult for the cybercrime police officials to recover the lost money, as the criminals use multiple mule accounts (dummy bank accounts opened with ID cards of illiterate people). They will be very quick in taking out the cash from ATM accounts, and this will be a dead end for the police officials.

Kaspersky also claim that scammers are also running fraudulent lotteries promising free iPhone devices as prizes, requiring participants to pass a survey, submit personal information (email addresses, phone numbers, etc.).

And, customers will be asked to pay a delivery or a service fee. There is also a fake feedback pane with users claiming to have received their 'prizes'.

Fake iPhone sale webpage.

So, people are advised to be very careful while shopping online.

Here are tips on how to safeguard yourself from online shopping fraud:

1) When buying phones or any product, always purchase them at the official stores only

2) Make it a habit to check the URLs and avoid unsolicited offers, ignore any unsolicited emails, texts, or ads promising deals or prizes.

3) Make sure to check the website's URL starts with 'https'. If it has just the 'http', avoid it at any cost

4) Be careful with lucrative offers posted on unknown websites and never share any personally identifiable data such as credit/debit card numbers, CVV, email, phone numbers, and Govt ID number

5) Never share any OTP with strangers online, even if they claim to be from an e-commerce app executive or bank official or even from the Income Tax department. Perform this action only face-to-face with the executive

6) Enable multi-factor authentication and monitor accounts: Activate 2FA on Apple ID and financial apps, and regularly review statements for unauthorised activity.

7) Also, install anti-virus apps on your computer or phone, as they will be able to flag if the website is compromised or not

Get the latest news on new launches, gadget reviews, apps, cybersecurity, and more on personal technology only on DH Tech.