ConsenSys-owned crypto wallet provider MetaMask has issued a warning to its users regarding Apple iCloud phishing attacks.

⠀

On March 29th, MetaMask expanded into the Apple ecosystem by adding Apple Pay integration to its app and website. Since then, it seems like some issues have appeared.

⠀

In a Twitter thread on Sunday, MetaMask’s team announced there is a security issue for all users who are using the wallet on iPhone, Mac, and iPad. For Apple users that have enabled automatic backups for their application data, their Metamask seed phrase gets automatically stored on the iCloud.

⠀

This introduces the risk of users losing their funds if their iCloud password “isn’t strong enough,” allowing attackers to target them with phishing tactics and eventually: gain access to their MetaMask wallet.

⠀

If this applies to you, make sure to disable MetaMask's automatic iCloud backups as described here:

MetaMask 🦊💙 @MetaMask

🔒 If you have enabled iCloud backup for app data, this will include your password-encrypted MetaMask vault. If your password isn’t strong enough, and someone phishes your iCloud credentials, this can mean stolen funds. (Read on 👇) 1/3

April 17th 2022

6,479 Retweets12,901 Likes

The warning comes a few days after Domenic Lacovone, known as revive_dom on Twitter, had his entire MetaMask wallet (holding $650,000 worth of cryptocurrencies and NFTs) stolen by hackers.

⠀

“Got a phone call from Apple, literally from Apple (on my caller ID). Called it back because I suspected fraud, and it was an Apple number. So I believed them. They asked for a code that was sent to my phone, and 2 seconds later, my entire MetaMask was wiped,” he shared.

⠀

For more from us at Waivly, join our free fun-to-read and to-the-point newsletter enjoyed by hundreds of people across the internet every day of the week 👇