Skip to main content
Question

GSX Phishing Scam

  • March 17, 2015
  • 13 replies
  • 18 views

Forum|alt.badge.img+15

FYI - There is a GSX account Phishing scam out there.

The "Check your account" button is NOT an Apple site.

13 replies

mm2270
Forum|alt.badge.img+24
  • Legendary Contributor
  • 7886 replies
  • March 17, 2015

Haha. So obvious its a scam with the horrible half English verbiage. Love that squished Apple logo too - nice touch!
Honestly, this is why these people will always be scammers and never amount to anything. They can't even bother to learn enough of a language to make a convincing phishing scam, which means they are just dolts.


Forum|alt.badge.img+5
  • New Contributor
  • 9 replies
  • March 17, 2015

I've been getting these periodically and it's always good for a laugh.

I forward each one to reportphishing@apple.com.


davidacland
Forum|alt.badge.img+18
  • Valued Contributor
  • 1811 replies
  • March 17, 2015

We get these quite often, pretty annoying but not much Apple can do about it really.


Forum|alt.badge.img+15
  • Contributor
  • 67 replies
  • March 17, 2015

I just started getting these a week or two ago. The first one was an announcement of iOS 8.1.4. @Chris.Ball Thanks for posting that, certainly can't hurt to send them Apple's way.


Forum|alt.badge.img+5
  • Contributor
  • 28 replies
  • March 17, 2015

Just got one of these today. Wondering if GSX may have been pwned... the email address they sent it to was a specially crafted one used ONLY for GSX, and yet I got the email there. Links resolve to "http://icloudappie.com". Nice.


Forum|alt.badge.img+12
  • Contributor
  • 222 replies
  • March 18, 2015

I've been getting a few of these just recently also.


donmontalvo
Forum|alt.badge.img+36
  • Hall of Fame
  • 4293 replies
  • March 18, 2015

Yea, not sure how these scammers got all our GSX addresses...

https://gsxapp.apple.com/WebApp/resourcesarticle.htm?documentid=SN2573&locale=en_US


Forum|alt.badge.img+11
  • Contributor
  • 176 replies
  • March 18, 2015

Just an FYI - If you had any e-mail accounts that were currently deactivated, it looks like those accounts might now be gone out of your account portal as part of this.


Forum|alt.badge.img+4
  • Contributor
  • 23 replies
  • March 18, 2015

I got this 5 minutes after actually emailing Apple about re-activating my account ( due to inactivity )


Forum|alt.badge.img+16
  • Valued Contributor
  • 291 replies
  • March 18, 2015

I've been getting these for a few weeks, the non secure, non apple web addresses have been an easy identifier for me (but I've seen so many phishing scams I'm always skeptical of any email that asks me to log in). Though there have been a few that had addresses that almost looked like a legit apple web address. This email address is only used for GSX and Apple's Discussion Board. I had assumed they trawled the discussion board profiles for addresses, not sure how else they would have obtained a not very public service address for me.


acodega
Forum|alt.badge.img+15
  • Valued Contributor
  • 383 replies
  • March 18, 2015

If you need to reactivate a disabled GSX account, like if it was disabled for inactivity or for extra security during the phishing uptick, you'll need to search for the account in GSX. It won't show up when you click People > Users.

If you do a search under the People section and enter the disabled account's email address, it will appear and you can unlock it easily.


Forum|alt.badge.img+26
  • Valued Contributor
  • 909 replies
  • November 15, 2016

I hate to reawaken this old thread, but I'm getting annoyed at this today! I can see right through these, but they keep coming in and our techs keep asking about them. Instructed folks not to respond to any GSX emails without checking with me first. I have notified Apple numerous times. I'm not seeing much else I can do about them. Does anyone have suggestions beyond that on how to deal with these that you use in your organization ?


talkingmoose
Forum|alt.badge.img+36
  • Community Manager
  • 1913 replies
  • November 15, 2016

Not much Apple can do about the spam at this point.

The string "GSX" is fairly unusual and not something you'd find in daily mail conversations.

  1. If you find the spammers are using GSX either in the subject line or body of the message and
  2. The message isn't coming from *.apple.com or a specific address and
  3. You have control over your mail server filters...

You might consider appending a POTENTIAL SPAM warning to the message before delivery.

Keep in mind your filter would catch Jamf Nation and similar messages from other legitimate sources, so be careful.