Unsolicited iPhone 15 Pro Max Delivery to Reddit User Sparks Fears of Targeted Cyber Attack
A Reddit user recently received an unsolicited iPhone 15 Pro Max delivered in a sealed retail box that the recipient had never ordered. The smartphone appeared brand new on the outside, yet verification of its serial number through Apple’s systems immediately raised red flags.
According to Apple’s records, the device had been purchased or activated as early as December 2023, and its warranty coverage had already expired in 2024. This timeline directly contradicts the pristine condition of the packaging, suggesting the phone inside may have been used or handled previously.
The shipment arrived with a FedEx shipping label, but the tracking number printed on the label could not be found in the carrier’s official tracking system. The recipient wisely chose not to power on the device, insert a SIM card, or link it to any personal network or Apple ID.
Community discussion on Reddit quickly turned to the possibility of a targeted cyber attack. Commenters speculated that an adversary might have sent a pre-modified handset as part of a whaling or spear-phishing operation aimed at extracting sensitive data or gaining access to high-value accounts once the phone was activated.
While the scenario resembles techniques sometimes associated with advanced targeted attacks, no definitive proof has emerged that the package was sent by malicious actors. It remains equally plausible that the delivery resulted from a logistics error, return fraud, or another non-security-related mix-up.
Security-conscious recipients of similar unsolicited devices are advised to leave the hardware powered off, avoid any network connections, and either submit it to Apple for forensic examination or recycle it through certified electronic-waste channels.
Related articles
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.
Silent Call Answering on Android: Defeating Phone Spam by Removing Human Attention
A detailed proposal suggests abandoning traditional spam call blocking in favor of allowing all incoming calls to connect automatically while keeping them invisible to the user. The approach uses Android's Telecom Framework and InCallService to answer calls silently without ringing, notifications, or screen activation. This breaks the economic model of mass dialing systems by inflating answered call metrics with empty connections that contain no human. The concept separates the technical establishment of a call from delivering user attention, forcing spammers to detect real people after the connection is made. Implementation requires the app to hold the ROLE_DIALER role and selectively invoke Call.answer() based on custom rules instead of always showing the incoming call UI. The author argues this shifts the detection burden onto robocall platforms and reduces the value of every successful connection.
Telegram Scam Bot Exposed by Fixed Timer and Deleted Messages in Telethon Userbot Analysis
A detailed investigation into a romance scam attempt on Telegram revealed an AI-driven userbot masquerading as a woman named Maria from Yaroslavl. The bot maintained consistent 4-5 minute response delays regardless of message length or time of day, responded to deleted messages, and accumulated multiple inputs before replying in batches. It refused out-of-character requests using repetitive phrases like "I am not a..." and handed off media or confusing inputs to a human operator. The bot failed to react to a nonexistent city name and ignored voice messages containing silence, leading to delayed human intervention. The chat was later deleted from the scammer side after testing, and the account ignored messages from a second profile. The analysis includes a full reconstruction of the bot's logic using the Telethon library, highlighting prompt protections against jailbreaks and reliance on fixed delays.
CACTER Upgrades PhishSim Anti-Phishing Simulation System to Reduce Employee Click Rates
CACTER has released an updated version of its PhishSim anti-phishing training platform that allows organizations to run realistic simulated attacks in just four steps. The system replicates common phishing vectors including malicious links, infected attachments, and disguised QR codes while spoofing sender addresses and official domains. Organizations can draw from a continuously refreshed template library covering invoices, financial subsidies, system notifications, and industry-specific scenarios. After each campaign the platform produces detailed visual reports that rank departments, classify employee risk levels, and recommend concrete remediation steps. Long-term use of the platform has been shown to lower average click rates from 23.88 percent to 4.16 percent. The solution is designed for immediate deployment without requiring dedicated security staff.