Loading story…
Apple said new anonymous relay addresses created through iCloud+ Hide My Email and Sign in with Apple will use the shared domain private.icloud.com, replacing the current split between privaterelay.appleid.com and icloud.com for newly generated addresses. The company said the change will roll out later this summer, while existing relay addresses on the legacy domains will continue to function without interruption.
Apple told developers, app operators, and email service providers to update validation logic, allowlists, filtering, suppression lists, and routing rules so messages sent to private.icloud.com are accepted alongside the older domains. The change has drawn criticism from some users, who argue that a distinct relay domain could make Hide My Email addresses easier for websites and apps to detect and potentially block, weakening the privacy feature’s usefulness for anonymous sign-ups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Apple said newly generated Hide My Email relay addresses will use the @private.icloud.com domain instead of prior domains, while existing addresses will continue to function without interruption. The company also told developers and email providers to update filtering, validation, allowlists, and routing to recognize the new domain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehelpnetsecurity.com
Open sourcetechcrunch.com
Open sourcedeveloper.apple.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A reported vulnerability in Apple’s iCloud+ **Hide My Email** service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher **Tyler Murphy** of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that **404 Media** independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services. Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the `@private.icloud.com` domain could make Hide My Email aliases easier for websites and apps to identify and block.
Jul 4, 2026
Apple unveiled an **Apple Intelligence** feature for `iOS 27` that can automatically change passwords for compromised or weak accounts in Safari and the Apple Passwords app. Instead of only warning users that a credential is weak, duplicated, or exposed in a breach, the new capability can take users directly through remediation by generating a strong replacement password and saving it to their password vault. Apple said the feature is designed with a privacy-first architecture that combines on-device processing with **Private Cloud Compute**. When a user reviews compromised credentials, they can tap a single **Fix** option and Safari will handle the reset flow on supported sites by signing in, navigating to the password-change page, creating a unique high-entropy password, and storing it automatically, with progress surfaced through **Live Activities** in Notification Center. Apple positioned the feature as a way to address the common problem of users ignoring breach alerts, helping reduce password reuse and lowering the risk of credential-stuffing attacks when the update ships later this year.
Jun 29, 2026