Yeah, this is because the user has been phished and compromised the AppleID password. But The most important issue in this incident is that a user modifying 2F

Yeah, this is because the user has been phished and compromised the AppleID password. But The most important issue in this incident is that a user modifying 2FA information on an AppleID account does not require confirmation of the 2FA. I think it's a major program flow security vulnerability. The 2FA should be the last security measure for Apple ID, even if the Apple ID password has been compromised. In most sence, people who try to steal can't skip the 2FA, util they find the way to skip 2FA: sign in at a trusted device of the Apple ID. > 1. The user must have motivation to download the malicious app. In fact, the App of this case is available in AppStore. The developer of the App has a server to change App appearance, and pass the Appstore review. > 4. The end-user must believe that the Sign in alert originates from the system Yes, the Sign in alert is originates from the system. You can view this picture, and think about whether you realize you're signing into your Apple ID in the first place. This is the picture: https://i.imgur.com/cexSIbrl.jpg https://i.imgur.com/cexSIbrl.jpg