Colin Brady

❗️ Attackers could use iCloud to send email as any icloud[.]com address, including [email protected], while still passing SPF, DKIM and DMARC, the email authentication checks built to stop spoofing. Researchers found and reported two parsing flaws in Apple's mail servers. An early fix by Apple only blocked the word "admin" and the full patch took 18 months. Apple paid them $15,000.

‼️ BREAKING: Revolut handed over customers’ passport copies, verification selfies and full transaction histories to a malicious actor. The actor sent lawful government information-demand emails using a genuine government domain that passed domain authentication. Revolut later concluded they were not authentic. Affected customers were notified on Friday. What may have been disclosed ranges from name, date of birth and home address to account statements, withdrawal records and complete Bitcoin transaction history. The company says it has alerted the agency to the unauthorised mailbox on its domain, blocked the address and begun notifying regulators. It has not named the agency, explained how someone obtained a mailbox there, or given a number of affected customers. ZachXBT, who circulated the notices, believes the incident was limited in size and aimed at high-net-worth users.