My Apple Developer account was hacked today.
Email changed. Phone numbers changed. Apps being transferred without my consent.
8 apps. My entire business at risk.
Has anyone dealt with this? How did you recover? @Apple@AppleSupport#BuildInPublic
Please RT 🙏
@CihadTurhan@alpennec@ChrisKruegerDev@juanjovn They managed it in about 30 minutes, which was completely insane. I was surprised by how quickly it happened; I’ve never done an app transfer so I wasn’t familiar with the process. However, it’s absolutely true they did it in about 30 minutes…
@alpennec@CihadTurhan@ChrisKruegerDev@juanjovn During an Apple call on Saturday, the app was transferred in about 30 minutes. I can share a screenshot via DM since he accessed the account and removed all related emails.
@_appcartel@Apple@AppleSupport Still figuring it out, but session cookie hijacking is on the table. Steal a valid auth cookie, replay the session and 2FA becomes completely irrelevant. No password needed. 😕
My Apple Developer account was hacked today.
Email changed. Phone numbers changed. Apps being transferred without my consent.
8 apps. My entire business at risk.
Has anyone dealt with this? How did you recover? @Apple@AppleSupport#BuildInPublic
Please RT 🙏
@alpennec@juanjovn Thank you so much Axel! It really means a lot to me. You have no idea how much I appreciate it.
Tomorrow starts my first day, report + apple developer support💪
mi apuesta es session cookie hijacking. alguien robó una auth cookie válida, replicó la sesión y el 2FA quedó completamente irrelevante. ni contraseña necesitó
también pinta que clonaron mi password vault, así que no es solo una cuenta
llevamos 48h en modo supervivencia, como la cuarentena pero en digital. revisando sesiones, rotando credenciales, cerrando accesos uno a uno
mañana lunes denuncia + soporte developer de apple. los fines de semana no hay línea telefónica así que aquí seguimos 💀
ni en las películas de miedo, terrible...
nope. used apple's official site only
but here's the thing: i got the SMS *before* changing my password. attacker already had access at that point
my bet? session cookie hijacking. steal a valid auth cookie, replay the session, 2FA is completely irrelevant. no credentials needed
maybe also cloned my password vault. still tracing the initial vector, possibly a malicious link clicked somewhere without realizing it 💀
@BenToFound@Apple@AppleSupport I have contacted Developer Support from a different account, waiting for their response. What's the best way to reach Apple Business Support directly?
Already called. 50 minutes on the phone, they remoted into my PC, and they guide me to literally try Forgot Password, I couldn't reset because the recovery number was changed by the attacker. Literally told me "we can't help you, contact Developer Support." Developer phone support doesn't work on weekends. Trust me the first thing was calling them.