The attack then transitions to its second phase, presenting victims with a fake “Apple Pay Refund” interface requesting credit card details under the pretext of processing the subscription refund. Cybercriminals have begun exploiting the widespread popularity of CapCut, the dominant short-form video editing application, to orchestrate sophisticated phishing campaigns targeting Apple ID credentials and credit card information. The attack campaign employs meticulously crafted fake CapCut subscription invoices distributed via email, presenting recipients with fraudulent billing notifications for CapCut Pro subscriptions priced at $49.99 per month. These deceptive communications incorporate official CapCut branding and Apple Store references, creating an authentic appearance that instills trust in potential victims. This emerging threat demonstrates how attackers strategically leverage trending applications to enhance the credibility of their malicious schemes, creating convincing lures that deceive unsuspecting users into surrendering sensitive personal and financial data. Upon credential submission, the malicious site executes an HTTP POST request to the command-and-control server at IP address 104[.]21[.]33[.]45, transmitting stolen Apple ID credentials in plaintext format. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This domain, completely unrelated to legitimate Apple services, presents an authentic-looking interface that mimics official Apple branding and design elements. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The researchers noted that threat actors have implemented advanced social engineering tactics, combining urgency-driven messaging with financial incentives to manipulate victims into compliance. This final component serves to delay victim suspicion and prevent immediate incident reporting, allowing attackers additional time to exploit harvested credentials before detection. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 27 Jun 2025 13:25:11 +0000