Skip to Content

Got a tip for us?Let us know

a. Send us an email
b. Anonymous form

New iOS Mail Bug Allows iCloud-Like Popups to Steal User Passwords

Wednesday June 10, 2015 7:09 AM PDT by Mitchel Broussard

A new bug facing the iOS Mail app was found recently by security specialist Jan Soucek (via The Register). The malicious bug is capable of delivering false iCloud log-in prompts by allowing remote HTML content to be loaded through an email message delivered to the intended victim. The bug then delivers a convincing iCloud log-in box for users to re-enter their Apple ID and password. Soucek says that Apple did not respond to his discovery of the bug when he stumbled across it back in January.

Watch on YouTube

"Back in January 2015 I stumbled upon a bug in iOS's mail client, resulting in HTML tag in e-mail messages not being ignored. This bug allows remote HTML content to be loaded, replacing the content of the original e-mail message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password "collector" using simple HTML and CSS."

The bug isn't relegated to only iCloud phishing attacks, however, letting anyone with access to it customize the attack to ask for whichever username and password credentials they feel the need for. Soucek kept the details of the bug only between himself and Apple, letting the company have time to possibly fix the attack and inform him of its progress. Given the company's remaining quietness on the subject, he decided to publish the proof of concept - called the Mail.app inject kit - on GitHub in hopes of spreading its awareness.

"It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2. Therefore I decided to publish the proof of concept code here."

While Soucek's actions bring the malicious bug to more people's attentions and can help stop it in due time, it also means there's a wider chance for phishers to deploy it on their own. Until Apple comments on the story and offers a fix for the bug, it'll be safest to take precaution when any password prompt emerges while browsing email in iOS.

Related Forum: iOS 8

Top Rated Comments

149 months ago

I've been having issues with repeated requests to log into iCloud for a while so if this happened while I was in Mail, I wouldn't know if it were simply more of the same or a malicious one via Mail itself. You people on here being so smug talking smack about your wives being so dumb need to stop before you embarrass yourself. well, too late but I mean after you also fall for it. This is different than falling for a regular phishing email .

Score: 11 Votes (Like | Disagree)

149 months ago

Will the fake dialog swipe/scroll when you scroll the email? If so, that's a quick check as a defensive stopgap for those who want to watch out for this. A real dialog would be stuck to the screen and not move when you scroll.

Score: 6 Votes (Like | Disagree)

149 months ago

Splendid... My wife would fall for that.

Score: 6 Votes (Like | Disagree)

149 months ago

Turn two factor authentication or app-specific passwords on (or both) and this will not be a problem. Though obviously it is something that Apple needs to fix.

Score: 5 Votes (Like | Disagree)

149 months ago

That's not something Apple can control without removing features from Mail that exist in literally every modern e-mail client. Essentially what is happening here is Mail is rendering a website. It's a very small website and it's been designed to look like Apple's UI to trick you.

So here are Apple's options:

* They could disable HTML / CSS completely, and push Mail back into the dark ages.
* They could offer a toggle to disable HTML / CSS in Mail, which few people would use and would cause unexpected issues when a valid e-mail requires HTML / CSS to render.
* They could disable specific HTML like FORMS, which would prevent this particular scam but again, cause unexpected issues when a valid e-mail has a valid form.
* They could scan the email for specific html like FORMS and provide a notice/alert that the email might be attempting to steal passwords. This is probably the best scenario but even so it would scare users away from legitimate emails using forms (which granted, are very few)

But again... this e-mail would look the same and FUNCTION the same whether you viewed it on iOS, or OS X, or Windows, or via Safari or Chrome or Opera... whether you loaded the email from Mail.app or via iCloud or Gmail or Outlook or any other email client.

And any "fix" Apple takes on its end is really only a bandage. It wouldn't prevent this phishing email from functioning on other e-mail clients and any "fix" they offer has downsides as listed above.

It's not an exploit. It's not a bug. It's not something that can only affect iOS users outside that it vaguely looks like the iOS environment. It's not a "Meta tag issue" or the result of some faulty programming on the part of Apple's iOS development team.

Perhaps if Apple's own prompts to ask for iCloud passwords here and there weren't as common or secured in some way to clearly be unique to an actual valid system prompt then things of this nature wouldn't have as much potential of being abused.

You haven't checked the link, have you? https://github.com/jansoucek/iOS-Mail.app-inject-kit
It is a meta tag issue, and your four bullets above wouldn't do anything to stop it. The email doesn't have a form, the email redirects the user to a webpage (within the mail client) that has a form. Big difference. And as the person has described, it doesn't work the same way in all mail clients, as others wouldn't follow the meta refresh.
Go read up, then come back and change your mind.

And then there's that.

Score: 4 Votes (Like | Disagree)

149 months ago

Perhaps if Apple's own prompts to ask for iCloud passwords here and there weren't as common or secured in some way to clearly be unique to an actual valid system prompt then things of this nature wouldn't have as much potential of being abused.

I posted a good while ago about exactly this problem. Of my four iCloud enabled devices I must get at least one spurious iCloud password prompt per day (although some periods are worse than others). It seems to be either iMessage and its eternal struggle to get a ****ing grip, or FaceTime, or some other cluster that's gone off behind the scenes. And these prompts are rarely related to me actually trying to so something iCloud related. Just turn on the iPhone, and 'enter your iCloud password'. Apple don't even say why, just training us, like good little dupes, to hand it over whenever some plain white box asks for it.

Score: 3 Votes (Like | Disagree)

Read All Comments

Popular Stories

Apple MacBook Pro with PROLED XDR Display family lineup feature

Apple Announces OLED MacBook Pro With Touch Display

Wednesday October 28, 2026 10:11 am PDT by Juli Clover

Apple today announced a new high-end MacBook Pro, which is available in 14-inch and 16-inch sizes. The new device has a PROLED XDR display that supports touch gestures, and a glowing rear Apple logo. Pricing on the MacBook Pro starts at $2,899 for the 14-inch model and $3,399 for the 16-inch model. Apple says the MacBook Pro has the "world's best display in a pro laptop." The PROLED...

• 731 comments

iPhone Duo Display Cracking

Apple Alerts Stores to iPhone Duo's Display Cracking Issue

Friday October 30, 2026 3:20 pm PDT by Joe Rossignol

In a memo shared with Apple Stores and Apple Authorized Service Providers this week, and later obtained by MacRumors, Apple provided technicians with guidance on how to diagnose and address the iPhone Duo's inner display cracking issue. If a customer reports the issue, Apple advised technicians to inspect the iPhone Duo and repair or replace it in accordance with their standard procedures....

• 221 comments

iPad mini OLED feature 1

Apple Executive Comments on New iPad Mini Lacking 120Hz Display

Thursday October 29, 2026 1:47 pm PDT by Joe Rossignol

While the new iPad mini has an OLED display, the device does not support ProMotion, meaning the display's refresh rate is limited to 60Hz instead of 120Hz. ProMotion support would have allowed for the iPad mini's refresh rate to automatically adjust from 10Hz to 120Hz depending on the content being displayed, but evidently Apple has kept the feature exclusive to the iPad Pro among iPad...

• 243 comments

Latest Stories

Apple Watch Ultra 4 Hits All-Time Low Price With Amazon's $99 Discount

Reminder: Apple's Big Discount on Beats 360 Ear Cushions Ends Today

Here's a New Tour of Apple's HomeView Software

Apple Reveals New iPad Mini's Battery Capacity

Top Stories: Apple's Big MacBook Pro, iPad mini and iMac Updates

'Pluribus' Season 2 Reportedly Starts Production Today

iPhone 18 Pro Sales Surge in China, Offsetting Decline in U.S. and Japan

HomeView Software 27.2: Wallpapers, Control Center, and More

Apple Alerts Stores to iPhone Duo's Display Cracking Issue

iOS 27.3 Will Enable These Apple Intelligence Features in China

Apple Says iOS 27.3 Beta Coming Next Week

Apple's Flash Storage Suppliers Are Finally 'Getting Their Revenge'

14 New Things Your iPhone Can Do in iOS 27.2

iPhone Duo Review: One Week Later

Samsung Mocks iPhone Duo Display Cracks in New Ad Campaign

The MacRumors Show: OLED MacBook Pro, iPad Mini 8, and More

MacBook Pro With Touch Display: 15 More Details Revealed

Russia Places Apple on State Surveillance Registry

Halloween Weekend Brings Discounts on Apple Accessories and Pre-Orders

Apple Has Released More Than 25 New Products in the Past Two Months

Local Code Launches as Free, Private AI Assistant Tool for Mac

Apple Acquires Ascend.io

HomePod Mini 2 Launches Today: All the New Features

AirTag 2 4-Pack Drops to New Low Price of $69.99

Rian Johnson's iPhone Camera App Goes Viral

Where Did All the iPhone Duos Go? Mostly to Apple's Stores

Apple's Touchscreen MacBook Pro Could Ship 1.5M Units in 2027

New Apple TV 4K and iPad Mini: RAM Amounts Revealed

Apple Executive Comments on New iPad Mini Lacking 120Hz Display

Here's a Hands-On Look at HomePod Mini 2's New Two-Tone Colors

🔗 Related Apple News & Rumors

Stay updated with the latest Apple ecosystem news and verified rumors