This is a very widespread and advanced phishing campaign that utilizes web pages that look identical to the real Apple account pages and psychology that continues to draw a victim through the various screens of this attack. This include opening bank or credit card accounts, accessing other accounts with the information, or filing tax returns under the victim's name. If a user had entered their information, the attackers will now have enough to perform a complete identify theft of the victim. ? I didn't purchase an app' and opening the PDF to see what's going on. Instead the attackers are relying on the victim saying 'What the. The email contains a PDF attachment that states it's a receipt for the purchase, but there is nothing telling you to open the attachment.

The campaign works by a victim receiving an email that pretends to be a receipt for a recent purchase from the Apple App Store. It was not until I started researching this campaign that I learned how widespread it is. I first learned about this campaign this weekend when three different people during the course of a single weekend told me that they had received an email stating that they purchased an app from the Apple App Store when they know that they did not. Once a user clicks the link, down the rabbit hole they go. These emails contain a PDF attachment that pretends to be a receipt for an app that was purchased by your account for $30 USD and tells you to click a link if the transaction was unauthorized. A widespread and sneaky phishing campaign is underway that pretends to be a purchase confirmation from the Apple App store.

Fake app store receipt