Korean researcher details scheme abusing Apple's third-party pickup policy

Researchers exposed a phishing-driven criminal operation called “Poisoned Apple” (active 2021–2023) that collected ~8,000 stolen credit cards and over five million personal records via fake payment pages, then used those cards to buy Apple products and resell them through second-hand marketplaces by naming buyers as designated third-party pick-up persons. The campaign targeted residents of Korea and Japan, demonstrated technical and operational sophistication (bypassing Korean multi-factor payment requirements and using Cloudflare, with configuration errors revealing origin servers), and is attributed by investigators to actors likely based in China.