Paul Sinclair 

🧑🏼‍💻 iOS / Android / Mobile Developer
📲 Mobile Development
🚀 Computer Science
🌟 Swift / SwiftUI

[Paul Sinclair  @ORIPIK1]

My Apple Developer account was hacked today.

Email changed. Phone numbers changed. Apps being transferred without my consent.

8 apps. My entire business at risk.

Has anyone dealt with this? How did you recover? @Apple @AppleSupport #BuildInPublic

Please RT 🙏

[Paul Sinclair  @ORIPIK1]

@oliverbytes @filippkowalski App removed

[Paul Sinclair  @ORIPIK1]

🤯

[Mohammad Kaif @_mkahmad]

Yay! I was rewarded $15,000 bounty from Apple.

Account takeover via App Store 👀

#bugbounty #cybersecurity #pentesting

[Paul Sinclair  @ORIPIK1]

@juanjovn @CihadTurhan @alpennec @ChrisKruegerDev They take three days to review an update but an app transfer is instantly approved, okk igg….

[Paul Sinclair  @ORIPIK1]

@CihadTurhan @alpennec @ChrisKruegerDev @juanjovn They managed it in about 30 minutes, which was completely insane. I was surprised by how quickly it happened; I’ve never done an app transfer so I wasn’t familiar with the process. However, it’s absolutely true they did it in about 30 minutes…

[Paul Sinclair  @ORIPIK1]

@alpennec @CihadTurhan @ChrisKruegerDev @juanjovn During an Apple call on Saturday, the app was transferred in about 30 minutes. I can share a screenshot via DM since he accessed the account and removed all related emails.

[Paul Sinclair  @ORIPIK1]

@_appcartel @Apple @AppleSupport Still figuring it out, but session cookie hijacking is on the table. Steal a valid auth cookie, replay the session and 2FA becomes completely irrelevant. No password needed. 😕

[Paul Sinclair  @ORIPIK1]

My Apple Developer account was hacked today.

Email changed. Phone numbers changed. Apps being transferred without my consent.

8 apps. My entire business at risk.

Has anyone dealt with this? How did you recover? @Apple @AppleSupport #BuildInPublic

Please RT 🙏

[Paul Sinclair  @ORIPIK1]

@offscriptcheryl @anumness @Apple @AppleSupport Sure!!

[Paul Sinclair  @ORIPIK1]

@alpennec @juanjovn Thank you so much Axel! It really means a lot to me. You have no idea how much I appreciate it.

Tomorrow starts my first day, report + apple developer support💪

[Paul Sinclair  @ORIPIK1]

@_artcc_ @juanjovn btw no descarto que haya sido openclaw. si pulsa un enlace malicioso sin darte cuenta, te roba la cookie y game over

[Paul Sinclair  @ORIPIK1]

mi apuesta es session cookie hijacking. alguien robó una auth cookie válida, replicó la sesión y el 2FA quedó completamente irrelevante. ni contraseña necesitó

también pinta que clonaron mi password vault, así que no es solo una cuenta

llevamos 48h en modo supervivencia, como la cuarentena pero en digital. revisando sesiones, rotando credenciales, cerrando accesos uno a uno

mañana lunes denuncia + soporte developer de apple. los fines de semana no hay línea telefónica así que aquí seguimos 💀

ni en las películas de miedo, terrible...

[Paul Sinclair  @ORIPIK1]

nope. used apple's official site only

but here's the thing: i got the SMS *before* changing my password. attacker already had access at that point

my bet? session cookie hijacking. steal a valid auth cookie, replay the session, 2FA is completely irrelevant. no credentials needed

maybe also cloned my password vault. still tracing the initial vector, possibly a malicious link clicked somewhere without realizing it 💀

[Paul Sinclair  @ORIPIK1]

@bil0090 @anumness @Apple @AppleSupport Thank you sou much 🤍

[Paul Sinclair  @ORIPIK1]

@twannl @Apple @AppleSupport Thank you so much Antoine ❤️ Let’s see how it develops.

[Paul Sinclair  @ORIPIK1]

@AlgoCloudz @Apple @AppleSupport Yes, MFA enabled.

[Paul Sinclair  @ORIPIK1]

@MikeKhristo @filippkowalski @Apple @AppleSupport 🥷

[Paul Sinclair  @ORIPIK1]

@BenToFound @Apple @AppleSupport I have contacted Developer Support from a different account, waiting for their response. What's the best way to reach Apple Business Support directly?

[Paul Sinclair  @ORIPIK1]

@twannl @Apple @AppleSupport It means a lot, truly appreciate it. I'll keep you all updated. 🤍

[Paul Sinclair  @ORIPIK1]

@sikorskymark @ruchernchong @Apple @AppleSupport Also, I emailed them from a different account.

[Paul Sinclair  @ORIPIK1]

Already called. 50 minutes on the phone, they remoted into my PC, and they guide me to literally try Forgot Password, I couldn't reset because the recovery number was changed by the attacker. Literally told me "we can't help you, contact Developer Support." Developer phone support doesn't work on weekends. Trust me the first thing was calling them.

[Paul Sinclair  @ORIPIK1]

@hey_hulya @Apple @AppleSupport I did, but i guess i have not been fast enough :(