Loading story…
A reported vulnerability in Apple’s iCloud+ Hide My Email service allows an attacker with only a relay alias to uncover the user’s real email address, defeating a privacy feature widely used to mask identity. Researcher Tyler Murphy of EasyOptOuts said he disclosed the issue to Apple in June 2025, and multiple outlets reported that 404 Media independently verified the flaw by recovering a reporter’s actual Apple ID email from a newly created alias. Public reporting says the issue requires no account compromise, special access, or social engineering, raising risks of phishing, spam correlation, account linkage, and exposure of personal details through people-search services.
Apple reportedly acknowledged the bug in 2025 and later told Murphy that a system change had addressed it, but follow-up testing found the deanonymization still worked more than a year after disclosure. Murphy said volunteer testing showed all tested aliases were reversible, though the full scope across the user base remains unclear, and exact exploitation details were withheld while Apple continued investigating. As of the reports, Apple had not issued a public advisory or CVE, and separate coverage noted that Apple’s planned migration of masked addresses to the @private.icloud.com domain could make Hide My Email aliases easier for websites and apps to identify and block.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Apple announced that anonymously generated Hide My Email addresses will transition to the @private.icloud.com domain. The change could make such aliases easier for websites and apps to identify and potentially reject.
Multiple outlets reported that Apple's Hide My Email feature could reveal users' real email addresses behind aliases, describing the flaw as unpatched and a significant privacy risk.
404 Media independently verified that a Hide My Email alias could be used to recover the underlying real email address, confirming the issue remained exploitable more than a year after disclosure.
By the end of May 2026, Apple told Murphy it was still investigating the Hide My Email flaw and expected to address it in a security update in the coming weeks.
In March 2026, Apple told Murphy that a recent system change had fixed the Hide My Email issue. Murphy subsequently found that the vulnerability was still exploitable.
Apple acknowledged Murphy's report in July 2025 after receiving the June 2025 disclosure, according to reporting on the issue.
Tyler Murphy of EasyOptOuts responsibly disclosed a vulnerability in Apple's Hide My Email service to Apple in June 2025, reporting that an alias could be used to uncover the underlying real email address.
EasyOptOuts published a guide on June 30, 2026 describing that Apple's Hide My Email could expose users' real email addresses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
tidbits.com
Open sourcescworld.com
Open sourcemalwarebytes.com
Open sourcetomshardware.com
Open sourcecybersecuritynews.com
Open source404media.co
Open sourcemacrumors.com
Open sourceeasyoptouts.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple said new anonymous relay addresses created through **iCloud+ Hide My Email** and **Sign in with Apple** will use the shared domain `private.icloud.com`, replacing the current split between `privaterelay.appleid.com` and `icloud.com` for newly generated addresses. The company said the change will roll out later this summer, while existing relay addresses on the legacy domains will continue to function without interruption. Apple told developers, app operators, and email service providers to update validation logic, allowlists, filtering, suppression lists, and routing rules so messages sent to `private.icloud.com` are accepted alongside the older domains. The change has drawn criticism from some users, who argue that a distinct relay domain could make Hide My Email addresses easier for websites and apps to detect and potentially block, weakening the privacy feature’s usefulness for anonymous sign-ups.
Jun 29, 2026
Researchers disclosed **EFAIL**, a set of attacks that can cause some email clients to leak the plaintext of previously intercepted **OpenPGP**- and **S/MIME**-encrypted messages. The attacks relied on clients automatically rendering active HTML content and, in some cases, weaknesses around message integrity handling, allowing crafted emails to exfiltrate decrypted content to attacker-controlled servers when a victim opened them. Reporting and follow-up commentary identified affected workflows in clients including **Thunderbird** and **Apple Mail**, and warned that simply using encrypted email standards did not guarantee protection if the surrounding client behavior was unsafe. The disclosure triggered immediate controversy over both severity and coordination. The **EFF** and other outlets urged users to disable HTML rendering and, as a precaution, avoid decrypting inside vulnerable mail clients, while researchers and developers said encryption could still be used more safely if messages were handled outside the email application. Enigmail's lead developer said fixes for Enigmail had already shipped while Thunderbird patches were still being finalized, and criticized the publication process for alarming users without clear mitigation guidance; subsequent reporting also said **Apple Mail** offered no practical defense against the attack at the client level beyond changing how encrypted mail was viewed.
Jun 29, 2026
AT&T exposed the email addresses of more than **114,000** iPad 3G customers through a web application that returned subscriber data when queried with valid `ICC-ID` values and an iPad-style user agent. Goatse Security used a script to enumerate identifiers and harvest addresses tied to high-profile victims, including corporate executives, media figures, government officials, and military personnel. Gawker publicized the incident after receiving sample data, while AT&T acknowledged the flaw, fixed it, apologized to customers, and said it would notify affected users; reporting at the time said the FBI opened an investigation. The disclosure quickly escalated into a criminal case against Goatse Security members Andrew "weev" Auernheimer and Daniel Spitler, with prosecutors alleging unauthorized access under the **Computer Fraud and Abuse Act** and related identity-fraud charges. Auernheimer was later convicted and sentenced to **41 months** in prison, though his case became a flashpoint in the security community over whether enumerating an openly accessible API constituted hacking or controversial vulnerability disclosure; later coverage noted his release after appellate proceedings without resolving the broader legal debate over security research and unauthorized access.
Jun 29, 2026