Apple fans deluged with phony password reset requests

Apple users are being targeted by a coordinated MFA 'bombing' campaign: attackers send large volumes of iForgot password-reset requests that generate system-level approval notifications, then follow up with spoofed Apple Support phone calls to socially engineer victims into providing one-time reset codes. The campaign leverages harvested personal data (reportedly from a data broker) and may exploit insufficient rate-limiting on Apple's reset flow, increasing the risk of account takeover.