Threat actors are now abusing Apple's own servers to send phishing emails. By triggering legitimate account change notifications, attackers can embed malicious links within emails that pass SPF/DKIM checks. This tactic exploits the inherent trust users place in 'system' notifications. [Sources: BleepingComputer]