SEC Consult

New Capabilities

As of October 2026: Published research; disclosed both vulnerabilities

A free iCloud account let an attacker send mail that appeared to come from tim.cook@icloud.com or any other @icloud.com address. The forged messages passed Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) — the three authentication checks most mail systems trust to separate real mail from forgery.

Updated Oct 7