❗️ Attackers could use iCloud to send email as any icloud[.]com address, including [email protected], while still passing SPF, DKIM and DMARC, the email authentication checks built to stop spoofing.
Researchers found and reported two parsing flaws in Apple's mail servers. An early fix by Apple only blocked the word "admin" and the full patch took 18 months.
Apple paid them $15,000.