Unsolicited iPhone 15 Pro Max Delivery to Reddit User Sparks Fears of Targeted Cyber Attack
A Reddit user recently received an unsolicited iPhone 15 Pro Max delivered in a sealed retail box that the recipient had never ordered. The smartphone appeared brand new on the outside, yet verification of its serial number through Apple’s systems immediately raised red flags.
According to Apple’s records, the device had been purchased or activated as early as December 2023, and its warranty coverage had already expired in 2024. This timeline directly contradicts the pristine condition of the packaging, suggesting the phone inside may have been used or handled previously.
The shipment arrived with a FedEx shipping label, but the tracking number printed on the label could not be found in the carrier’s official tracking system. The recipient wisely chose not to power on the device, insert a SIM card, or link it to any personal network or Apple ID.
Community discussion on Reddit quickly turned to the possibility of a targeted cyber attack. Commenters speculated that an adversary might have sent a pre-modified handset as part of a whaling or spear-phishing operation aimed at extracting sensitive data or gaining access to high-value accounts once the phone was activated.
While the scenario resembles techniques sometimes associated with advanced targeted attacks, no definitive proof has emerged that the package was sent by malicious actors. It remains equally plausible that the delivery resulted from a logistics error, return fraud, or another non-security-related mix-up.
Security-conscious recipients of similar unsolicited devices are advised to leave the hardware powered off, avoid any network connections, and either submit it to Apple for forensic examination or recycle it through certified electronic-waste channels.
Related articles
Dynamic QR Codes Enable Personalized Redirects and Conceal Final Destinations
Dynamic QR codes printed on menus, receipts, and advertisements do not contain the final destination URL. Instead they point to an intermediary service that logs each scan and issues a redirect chosen at scan time. The redirect decision can depend on device model, language, IP address, country, and previous scans, allowing different users to receive entirely different pages. Owners can change the target after printing without replacing the physical code, creating risks when domains or accounts change hands. Each scan records time, device details, and approximate location, leaving a trail users did not consent to. Attackers exploit these properties with overlay stickers, QR codes inside documents that bypass email filters, and fake payment pages that request card details instead of processing a true QR payment.
Booking.com Security Overlooked Fake Downing Street Listing in Which? Fraud Test
Researchers from Which? successfully listed a fake apartment at 10 Downing Street on Booking.com to test the platform's fraud defenses. The listing included the exact address, photos of the UK Prime Minister's residence, and a description of a one-bedroom property near Parliament. Booking.com processed a payment for a week-long stay and failed to refund it even after more than six weeks. A fabricated positive review mentioning the official cat Larry was approved almost instantly. The platform also permitted a phishing link sent through its internal chat system asking for credit card details. The listing remained active from June 18 until its removal on August 27, prompting Which? to call for an Ofcom investigation into Booking.com's systemic security failures.
Password Spraying Campaign Targets AWS Root Accounts in Over 150 Organizations
A password spraying campaign targeted AWS root accounts across more than 150 organizations between July 24 and August 23, 2026. Attackers performed repeated login attempts against identities holding maximum privileges in the cloud environment. The root account is created with every AWS account and grants full access to resources, configurations, billing, and sensitive administrative functions. Researchers observed a median of two attempts per organization, with some targets receiving up to eight attempts. No successful authentications linked to the campaign have been identified so far. The attacks leveraged distributed proxies across multiple countries and networks, including hosting infrastructure and residential proxies, while using user agents that mimicked older versions of Microsoft Edge and Firefox. Since June 2025, AWS has required MFA for root users, significantly raising the bar for account takeover even if a password is discovered.
Scammers Embed Phishing Inside Telegram Mini Apps After August Update
Cybercriminals are increasingly abusing Telegram's Mini Apps and WebView features to deliver phishing attacks that mimic legitimate banking, payment, and cryptocurrency services. Following the platform update on August 25, attackers can now present fake interfaces for transfers, airdrops, and voting systems directly inside the messenger. Victims are tricked into entering confirmation codes, connecting wallets, or pasting commands into PowerShell under the guise of fixing errors or claiming bonuses. The attacks rely heavily on social engineering rather than automated malware, requiring users to actively authorize actions such as signing transactions or providing phone verification details. Fake voting schemes are used to harvest account credentials, while crypto-related lures prompt users to link wallets to malicious services. Experts emphasize that simply opening a Mini App does not lead to immediate theft, but authorizing or connecting assets does expose users to significant risk.