Security News > 2021 > November > Ukraine arrests ‘Phoenix’ hackers behind Apple phishing attacks

The Security Service of Ukraine has arrested five members of the international 'Phoenix' hacking group who specialize in the remote hacking of mobile devices.
The goal of 'Phoenix' was to gain remote access to the accounts of mobile device users and then monetize them by hijacking their e-payment or bank accounts or selling their private information to third parties.
To steal mobile accounts of mobile device users, the actors used phishing sites that were clones of Apple's and Samsung's login portals.
The hackers also offered remote mobile phone hacking services to others, charging between $100 and $200. Finally, the group was also unlocking stolen or lost devices made by Apple, tied to the original purchaser by locking them to the first account created on the device.
The police have conducted five searches in each arrest location, seizing computer equipment, mobile phones, specialized software, and hardware.
Ukraine has been actively cracking down on cybercrime activity originating from their country, with recent arrests of ransomware members, money launderers, and threat actors behind DDoS attacks.
News URL
Related news
- DPRK Hackers Steal $137M from TRON Users in Single-Day Phishing Attack (source)
- Hackers Repurpose RansomHub's EDRKillShifter in Medusa, BianLian, and Play Attacks (source)
- Chinese FamousSparrow hackers deploy upgraded malware in attacks (source)
- North Korean hackers adopt ClickFix attacks to target crypto firms (source)
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)
- Russian hackers attack Western military mission using malicious drive (source)
- iOS devices face twice the phishing attacks of Android (source)
- Apple fixes two zero-days exploited in targeted iPhone attacks (source)
- Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks (source)
- Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) (source)