Apple removes end-to-end encryption for iCloud in the UK.

Summary

By the CyberWire staff

At a glance.

Apple removes end-to-end encryption for iCloud in the UK.
Phishing campaign abuses PayPal account feature.
Hackers steal $1.5 billion worth of cryptocurrency from Bybit exchange.

Apple removes end-to-end encryption for iCloud in the UK.

Apple has removed its Advanced Data Protection (ADP) feature for iCloud users in the UK following a secret legal demand by the British government, the Record reports. ADP provides end-to-end encryption for iCloud accounts. The British government had issued a Technical Capability Notice (TCN) requiring Apple to maintain the ability to access users' iCloud data when served a legal warrant. Rather than complying with the order, which would have required building a backdoor capability affecting Apple users worldwide, the company opted to disable the ADP feature in the UK.

Apple said it was "gravely disappointed" that ADP is no longer available for British users, adding, "As we have said many times before, we have never built a backdoor or master key to any of our products, and we never will."

Stop Identity-Based Cybercrime with SpyCloud’s Holistic Identity Threat Protection

Stolen identity data is the hot commodity for cybercriminals. With the full scope of your users’ digital footprints at risk for exposure, traditional account-centric security is no longer enough to protect your business from cyberattacks. SpyCloud helps security teams correlate and automatically remediate individuals' hidden identity exposures from breaches, malware, and phishing across their many online personas. Eliminate identity-based cyber threats and proactively defend against account takeover, fraud, and ransomware with SpyCloud.

Phishing campaign abuses PayPal account feature.

BleepingComputer warns that a phishing campaign is abusing PayPal's account address settings to send phishing emails from PayPal's legitimate mail server. The attackers add a "gift address" to their account, generating a notification email from PayPal which is customized by the scammers to include a fake purchase confirmation. This notification email is sent to a mailing list containing the targeted users' email addresses, telling users to call a phony PayPal support number in order to dispute the bogus payment.

BleepingComputer notes, "PayPal enables this scam by not limiting the number of characters in the address form fields, allowing the threat actors to inject their scam message. To fix this, PayPal needs to restrict the number of characters in the address field to a reasonable character count, like 50 characters, if not less."

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

Hackers steal $1.5 billion worth of cryptocurrency from Bybit exchange.

Hackers stole more than $1.5 billion worth of Ethereum from cryptocurrency exchange Bybit, SecurityWeek reports. CNBC notes that this is the largest single cryptocurrency theft in history. Bybit stated, "The transfer was part of a scheduled move of ETH from our ETH Multisig Cold Wallet to our Hot Wallet. Unfortunately, the transaction was manipulated by a sophisticated attack that altered the smart contract logic and masked the signing interface, enabling the attacker to gain control of the ETH Cold Wallet. As a result, over 400,000 ETH and stETH worth more than $1.5 billion were transferred to an unidentified address."

The exchange added that it has "more than enough assets to cover the loss, with AUM exceeding $20 billion."

Notes.

Today's issue includes events affecting , and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

FatalRAT attacks in APAC (Kaspersky ICS CERT) Kaspersky ICS CERT analyzes the backdoor that was delivered via an overly long infection chain to Chinese-speaking targets

Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign (Check Point Research) Highlights Introduction While the abuse of vulnerable drivers has been around for a while, those that can terminate arbitrary processes have drawn increasing attention in recent years. As Windows security continues to evolve, it has become more challenging for attackers to execute malicious code without being detected. As a result, the attackers often aim to […]

Hackers steal $1.5 billion from exchange Bybit in biggest-ever crypto heist (CNBC) Bybit, a major cryptocurrency exchange, has been hit by the largest crypto heist in history.

Trends

Former NSA, Cyber Command chief Paul Nakasone says U.S. falling behind its enemies in cyberspace (CyberScoop) In a wide-ranging speech and interview, Nakasone also talked about Trump administration moves and the shape of cyber offensive operations.

Legislation, Policy, and Regulation

Top House E&C Republicans query public for ideas on data privacy law (CyberScoop) A request for information from GOP leaders on the House Energy and Commerce Committee is Congress’ latest attempt to push comprehensive data privacy standards.

Kaspersky Banned on Australian Government Systems (SecurityWeek) Australian government entities have been banned from using products and services of Russian cybersecurity company Kaspersky.

Experts Slam Government After “Disastrous” Apple Encryption Move (Infosecurity Magazine) Experts argue Britons are now less secure after their government effectively forced Apple to abandon end-to-end encryption

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

The Business of Space Conference (Huntsville, Alabama, Feb 23 - 25, 2025) Engage with top academics, business leaders, innovators, and policy influencers working on the new space economy. Dive into keynote presentations and discussions that foster collaboration between researchers and space economy industry stakeholders. These conversations will present the latest insights into the new space economy and shape future academic and policy research.

GovMilSpace (Washington, DC, USA, Mar 10 - 13, 2025) Demystify the future of space technology. In alignment with the SATELLITE Conference & Exhibition, GovMilSpace brings together government and military agencies, the intelligence community, and satellite and space industry partners to explore how private industry can enhance critical missions for the U.S. and its global allies.

Satellite 2025 (Washington, DC, USA, Mar 10 - 13, 2025) For 40+ years SATELLITE has gathered the global space and satellite communities for four immersive days of enterprise, insights, and innovation. This year, with the debut of GovMilSpace, SATELLITE expands its reach to address the needs and priorities of the defense sector.

WICYS 2025 (Dallas and Virtual, Texas, USA, Apr 2 - 5, 2025) WiCyS 2025 is the go-to event for cybersecurity professionals, students, and organizations. The conference is the flagship event to recruit, retain and advance women in cybersecurity.

40th Space Symposium (Denver and Virtual, Colorado, USA, Apr 7 - 10, 2025) Bringing together leaders from commercial, government and military space from around the world, the Space Symposium provides a forum to discuss, address and plan for future achievements in space. The Space Symposium program delivers exclusive networking and engagement opportunities with influential participants in one convenient and extraordinary venue. Space Symposium luncheons and dinners provide additional contact with influential participants.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.24.25

At a glance.

Apple removes end-to-end encryption for iCloud in the UK.

Phishing campaign abuses PayPal account feature.

Hackers steal $1.5 billion worth of cryptocurrency from Bybit exchange.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Legislation, Policy, and Regulation

Events