Recent ‘MFA Bombing’ Attacks Targeting Apple Users

Multiple Apple customers reported a phishing campaign that inundates victims with system password-reset prompts (MFA fatigue or "push bombing") so attackers can follow up with spoofed Apple Support calls requesting one-time codes; if provided the attackers can reset Apple ID passwords and remotely wipe devices. Victims experienced dozens to hundreds of prompts across devices and watches; enabling Apple Recovery Keys did not stop the prompts, and testing shows Apple’s forgot-password flow can trigger alerts using the phone number on file. The report suggests attackers may be abusing a rate-limiting weakness in Apple’s password reset process and offers mitigation ideas such as using obscure VOIP numbers or email aliases.