--- title: This Apple “AirTag” Vulnerability could be harvesting your credentials description: During late September, the headlines were hit with the news of a vulnerability within Apple’s AirTag. Targeting good Samaritans and the curious by using Cross-Site Scripting (XSS), the vulnerability allows malicious actors to steal iCloud credentials and gain access to a victims account. image: https://csacyber.com/hubfs/airtag2.png --- [Skip to content](https://csacyber.com/blog/this-apple-airtag-vulnerability-could-be-harvesting-your-credentials#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search October 20, 2021 2 min read time # This Apple “AirTag” Vulnerability could be harvesting your credentials ![Cyber Security Associates](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Cyber Security Associates -](https://csacyber.com/blog/author/cyber-security-associates) [Article](https://csacyber.com/blog/tag/article) ![](https://csacyber.com/hubfs/airtag2.png) ### Executive Summary During late September, the headlines were hit with the news of a vulnerability within Apple’s AirTag. Targeting good Samaritans and the curious by using Cross-Site Scripting (XSS), the vulnerability allows malicious actors to steal iCloud credentials and gain access to a victims account. We’re unaware if Apple has patched this vulnerability yet, and it seems like it swept underneath the rug on this occasion. But, what even is an AirTag? If you’ve heard of a “Tile” before, then it’s essentially Apple’s version of that. If not, it’s a geolocation tracking device that allows users to find their valuables, given that the device is attached or located with it. You could add it to your keyring or put it in your car, but using Apple’s “Find My” app within iOS and macOS devices, end-users can locate their devices wherever they are in the world for as little as £29. You might be asking: “what happens if I lose an AirTag and can’t see it on the ‘Find My’ app?” Fortunately, you won’t be out of luck just yet. A feature called “Lost Mode” allows an AirTag to have a final swansong and when recovered. It retrieves information about the owner, allowing the finder to contact them and (hopefully) retrieve their lost belongings. The lost AirTag page allows its owner to insert any information to help the person who found the device and belongings return them to the rightful owner. Sadly due to the world that we live in, malicious actors have discovered a way to inject arbitrary code into the mobile phone number section of the “Lost Mode” configuration page. Users are redirected to a spoofed phishing login page, which captures the credentials of the victim attempting to rehome the device with its owner. So, how can you avoid falling victim? Normally upon scanning the lost AirTag, you’ll be met with a page like this: ![](https://csa.limited/assets/img/blog/airbag-1.jpg) A sample “Lost Mode” message. Image: Medium @bobbyrsec In an ideal world, this page will provide you with all the information that you need to get in contact with the owner of the lost phone. If you see a page similar to the above, then proceed as usual. However, at the time of writing this article, should you find that you are redirected to a page that looks like a login page, then you have not landed yourself in the right place. It is best to assume that the device you’ve found is a credential harvesting device and not a lost AirTag. To find out more about our security solutions and E-learning courses to help you stay safe online, get in touch! Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cyber Security Associates", "url" : "https://csacyber.com/blog/author/cyber-security-associates" }, "dateModified" : "2024-12-06T16:02:10.335Z", "datePublished" : "2021-10-20T04:00:00.000Z", "headline" : "This Apple “AirTag” Vulnerability could be harvesting your credentials", "image" : [ "https://csacyber.com/hubfs/airtag2.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/this-apple-airtag-vulnerability-could-be-harvesting-your-credentials", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```