\n
![](\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjItMDQvZTI4ZDgxOTUtZTEwNC00ZWIwLWJmMjktYjE0MzE4ODMxNGY0LmpwZw==.jpg\")
<\/p>\n
\n<\/p>\n
ConsenSys-owned crypto wallet provider MetaMask has sent out a warning to the community regarding Apple iCloud phishing attacks. <\/p>\n
The security issue for iPhone, Mac, and iPad users<\/a>\u00a0is related to default device settings which see a user\u2019s seed phrase or \u201cpassword-encrypted MetaMask vault\u201d stored on the iCloud if the user has enabled automatic backups for their app data. <\/p>\n In a Twitter thread posted on April 18, MetaMask noted that users run the risk of losing their funds if their Apple password \u201cisn\u2019t strong enough\u201d and an attacker is able to phish their account credentials<\/a>. <\/p>\n To fix the issue, users can disable automatic iCloud backups for MetaMask as detailed:<\/p>\n If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault. If your password isn\u2019t strong enough, and someone phishes your iCloud credentials, this can mean stolen funds. (Read on ) 1\/3<\/p>\n \u2014 MetaMask (@MetaMask) April 17, 2022<\/a><\/p><\/blockquote>\n The warning from MetaMask came in response to reports from an NFT collector who goes by \u201crevive_dom\u201d on Twitter, who stated<\/a> on April 15 that their entire wallet containing $650,000 worth of digital assets and NFTs was wiped via this specific security issue. <\/p>\n In a separate thread earlier today, DAPE NFT project founder \u201cSerpent\u201d \u2013 who also helped gain the attention of MetaMask via posting sharing the story with their 277,000 followers \u2014 gave a rundown of what happened to the victim.<\/p>\n They noted that the victim received multiple text messages asking to reset his Apple ID password along with a supposed call from Apple which was ultimately a spoofed caller ID.<\/p>\n As they were reportedly unsuspecting of the caller, \u201crevive_dom\u201d handed over a six-digit verification code to prove that they were the owner of the Apple account. The scammers subsequently hung up and accessed his MetaMask account via data stored on iCloud. <\/strong><\/p>\n Key takeaways \u2014 Serpent (@Serpent) April 17, 2022<\/a><\/p><\/blockquote>\n Related: <\/em><\/strong>MetaMask expands institutional offering by integrating new crypto custodians<\/em><\/strong><\/a><\/p>\n After MetaMask posted the warning today, \u201crevive_dom\u201d expressed<\/a> his frustrations with the company, noting that: <\/p>\n \u201cI\u2019m not saying they shouldn\u2019t do it but they should tell us. Don\u2019t tell us to never store our seed phrase digitally and then do it behind our backs. If 90% of the people knew this I would bet none of them would have the app or iCloud on.\u201d<\/p><\/blockquote>\n While most of the community response was supportive, others were quick to emphasize the importance of using cold storage and doing a lot of due diligence when storing assets in a hot wallet.<\/p>\n<\/div>\n\n
\n
– ALWAYS use a cold wallet to store your valuables
– Never give out verification codes to ANYONE
– Protect your information, don’t give out your phone number or your personal email
– Caller information is easy to spoof. Companies like Apple will never call you<\/p>\n