[1] is a better explanation of how this can be exploited. Basically, a victim finds an air tag, and as a Good Samaritan, opens the "found" link to attempt to r

[1] is a better explanation of how this can be exploited. Basically, a victim finds an air tag, and as a Good Samaritan, opens the "found" link to attempt to reunite the air tag with its owner. The key is, the victim may trust the Apple Airtag to direct them to a secure, private web page, so may be willing to do something like provide their iCloud credentials when prompted. It's not an attack that would be deployed indiscriminately -- it costs an attacker $30 for a chance that a desired target will find the Airtag, be a Good Samaritan and interact with the "found" page as hoped. But it could make sense against high value targets. [1] https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-credentials-with-apple-airtags-stored-xss-6997da43a216 https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred...