The campaign began as a Windows-focused operation, masquerading as Microsoft security alerts. Hosted on Microsoft’s own Windows.net platform—an Azure hosting service—it tricked users into believing their PCs were compromised. A fake warning would pop up, claiming the system was “locked,” while malicious code froze the underlying webpage, amplifying the illusion. Victims were then prompted to enter their Windows credentials, handing them straight to the attackers.
This ruse worked until early 2025, when Microsoft rolled out an “anti-scareware” feature in its Edge browser. Chrome and Firefox followed suit with similar defenses, slashing the attack’s success rate on Windows by 90%. Within two weeks, LayerX spotted a shift: the criminals retooled their approach for Mac users, specifically targeting those on Safari, who lacked equivalent protections. The result? A near-identical scam, now dressed up in macOS-friendly visuals and wording, still leveraging the same Windows.net infrastructure for credibility.
Why It’s So Effective
What sets this attack apart isn’t just its adaptability—it’s the polish. The phishing pages are professionally designed, mimicking Apple’s aesthetic down to the smallest detail. Add in the frozen webpage trick, and it’s easy to see why less tech-savvy users might bite. The attackers even use HTTP OS and user agent filters to zero in on Safari users, ensuring the scam lands where it’s most likely to succeed. “This level of sophistication is rare for Mac-targeted phishing,” LayerX notes, pointing to the campaign’s ability to bypass traditional defenses like Secure Web Gateways.
The shift also exploits a lingering myth: that Macs are inherently secure. While macOS has robust built-in protections, its growing market share—and users’ relative complacency—makes it an appealing target. Unlike the scattershot phishing emails of old, this attack feels tailored, leveraging compromised sites and rapid redirects to catch users off guard.
What’s at Stake for Mac Users
The goal is clear: steal Apple Account credentials (aka Apple IDs). With those in hand, attackers could access iCloud, disable Find My Mac, or even remotely lock or wipe devices. For the average user, this might mean lost photos or files; for professionals, it could spell compromised work data. The campaign often starts subtly—think a typo in a URL that leads to a parked domain, triggering a chain of redirects to the phishing page. By the time the fake alert appears, the trap is set.
Why It Matters Now
As of March 20, 2025, this attack underscores a broader trend: cybercriminals are getting smarter, and Macs are no longer a sidelined target. LayerX’s findings show how little effort it took to pivot from Windows to macOS—just some text tweaks and code adjustments—proving that attackers can adapt faster than defenses can catch up. With Safari users now “prime targets,” the pressure is on Apple to respond, though no immediate fix has been announced.
