Apple Passwords App Bug Left Users Vulnerable to Phishing Attacks for Months Before Being Fixed

Apple fixed a bug in its Passwords app with December's iOS 18.2 update that had left users vulnerable to phishing attacks in the three months since the launch of iOS 18.

Generic iOS 18 Passwords Feature
According to an Apple security update spotted by 9to5Mac, the Passwords app was sending unencrypted requests for the logos and icons associated with users' stored passwords.

Without protections of encryption, an attacker on the same Wi-Fi network could redirect a user's browser to a clone phishing site where login details could be stolen. The vulnerability was first discovered by developer Mysk's security researchers and reported in September.

Apple's iOS 18.2 security release notes described the bug like so:

Impact: A user in a privileged network position may be able to leak sensitive information

Description: This issue was addressed by using HTTPS when sending information over the network.


Apple lists the bug in security content updates for the Mac, iPad, and Vision Pro, indicating that this issue was fixed across multiple OSes.

Popular Stories

iOS 19 visionOS UI Elements

iOS 19 to Have Some of the 'Biggest' Design Changes in iPhone's History

Sunday March 16, 2025 10:35 am PDT by
Apple is planning some of the "biggest iOS and macOS redesigns in its history," according to Bloomberg's Mark Gurman. In his Power On newsletter today, Gurman reiterated that iOS 19 will have a visionOS-like design with more transparent interfaces:The new interfaces will adopt the design principles introduced in visionOS, the software for Apple's Vision Pro headset. That includes greater...
iphone 17 pro asherdipps

iPhone 17 Pro Max Rumors Allegedly Refer to 'iPhone 17 Ultra' Model

Friday March 14, 2025 7:56 am PDT by
If you've been following iPhone rumors over the last few years, you may remember reading reports that Apple flirted with the idea of introducing a super high-end "Ultra" model that would either replace its Pro Max device or sit above it in Apple's smartphone hirearchy. These reports appeared in the pre-launch iPhone 15 and iPhone 16 rumor cycles, but ultimately came to nothing. Now though, the...
Bent iPhone Air Feature

Apple Canned Larger iPhone 17 Air Model Over Fears of Bendgate 2.0

Monday March 17, 2025 4:07 am PDT by
Apple prototyped a larger ultra-slim iPhone 17 Air with a 6.9-inch display, but ultimately decided not to go ahead with the device because of fears that it could be susceptible to bending, according to a new report. Bloomberg reporter Mark Gurman, writing in his latest Power On newsletter: When it first started work on the phone, it prototyped a device with a 6.9-inch screen — matching...
iphone 16 pro models 1

Apple's First Foldable iPhone Estimated to Cost Nearly Twice as Much as iPhone 16 Pro Max

Monday March 17, 2025 6:42 am PDT by
In an investor research note today with British bank Barclays, analyst Tim Long said Apple's first foldable iPhone could have a starting price in the $2,300 range in the United States, which would make it by far the most expensive iPhone model ever. If the first foldable iPhone starts at $2,299, that means it would cost nearly twice as much as the iPhone 16 Pro Max, which starts at $1,199. ...
iphone 16 pro ghost hand

Next Year's iPhone 18 Pro Already Rumored to Have Five New Features

Tuesday March 18, 2025 1:00 pm PDT by
While the iPhone 18 Pro models are still around a year and a half away from launching, there are already some early rumors about the devices. Below, we recap some key iPhone 18 Pro rumors so far. Under-Screen Face ID In April 2023, display industry analyst Ross Young shared a roadmap showing that iPhone 17 Pro models would feature under-display Face ID. In May 2024, however, Young said ...
General iOS Mail Feature

iOS 18.3.2 Broke iCloud Mail Delivery

Monday March 17, 2025 3:31 pm PDT by
The iOS 18.3.2 update that Apple released last week appears to have broken iCloud Mail for some users. There are multiple complaints on Reddit and the MacRumors forums from users who say that iCloud Mail is not able to push new iCloud emails to their iPhones after the iOS 18.3.2 update. Affected users say that despite having the correct settings enabled, new iCloud emails are not showing up...
iphone 16 pro models 1

All Four iPhone 17 Models Rumored to Feature Upgraded 24-Megapixel Front Camera and More

Monday March 17, 2025 7:50 pm PDT by
All four iPhone 17 models launching later this year will feature an upgraded 24-megapixel front-facing camera, according to analyst Jeff Pu. In a research note today with investment firm GF Securities, Pu shared a chart in which he reiterated that the iPhone 17, iPhone 17 Air, iPhone 17 Pro, and iPhone 17 Pro Max will each be equipped with a 24-megapixel front camera. By comparison, all four ...
iPhone 17 Air Size Feature

'iPhone 17 Air' Rumored to Start at $899 With Surprisingly Good Battery Life, Camera Control, and More

Sunday March 16, 2025 9:05 am PDT by
Bloomberg's Mark Gurman today shared some new details about the rumored iPhone 17 Air. In his Power On newsletter, Gurman said he was told that the device may start at roughly $899 in the U.S., which means that it would occupy the same price point as the iPhone 16 Plus. This would make sense, as it has been widely rumored that the Air model will take over the Plus model's spot in the iPhone...

Top Rated Comments

iBluetooth Avatar
4 hours ago at 02:22 am
This bug is so basic, that Apple must be embarrassed as they should have some of their people verify security when the make their first passwords app, that is going to be used by millions ?
Score: 16 Votes (Like | Disagree)
MrRom92 Avatar
4 hours ago at 02:27 am
And through all the betas of iOS 18 nobody caught this
Score: 8 Votes (Like | Disagree)
code-m Avatar
4 hours ago at 02:25 am

This bug is so basic, that Apple must be embarrassed as they should have some of their people verify security when the make their first passwords app, that is going to be used by millions ?
Needs to be on the local wifi network, if you are using public wifi even at school or work the potential of being compromised would be there. If only at home no biggy unless your neighbours are creeps.
Score: 7 Votes (Like | Disagree)
steve09090 Avatar
4 hours ago at 02:30 am

And through all the betas of iOS 18 nobody caught this
No because it’s so niche and never actually caused an issue.

Unless your mates are salivating over you downloading a picture in your passwords app, it would never get picked up and never be a realistic problem.
Score: 7 Votes (Like | Disagree)
code-m Avatar
4 hours ago at 02:23 am
Privacy and Security ?
Score: 6 Votes (Like | Disagree)
wanha Avatar
2 hours ago at 04:02 am

If this… and if that… and only if this…. There might be an opportunity to do something.

But it’s fixed now.

When someone comes up who has actually been affected then I’ll join the whingers and complain.

It’s like saying a driver could drive through a red light and cause an accident. But it didn’t happen!!! And until it does.
Did you just say that you'll only complain about people driving through red lights once they cause an accident?
Score: 6 Votes (Like | Disagree)