5

I found a thread with a similar problem but it didn't seem to have a solution for this situation, so here goes:

I have, on 3 occasions now, received spam email (iPhone XS fake promos) to my personal Gmail account from my own iCloud account.

These emails have only been sent when my Mac is turned on. They show up in my iCloud account's "Sent" folder within the Mail app. I have verified that they have come from the IP address of my Mac. These emails have gone to my personal Gmail account and to no other addresses within my contact list. My Apple login is secured with 2FA and there have been no abnormal login attempts.

I share the Mac with family and it is possible that a ..questionable.. piece of software was installed by my son (pirated version of an app from a torrent site). Though, nothing that would have required an administrator password, which he does not have.

So, what do you think is happening here? And how do I stop it? I am currently using the latest Catalina public beta. I looked into Malwarebytes and it is not yet compatible.

Thank you in advance for any help you can offer!

Improve this question
4
  • Firstly, welcome to Ask Different! :) Interesting question! Can I ask, when you say you found a thread with a similar problem but it didn't seem to have a solution for this situation, was this another question on this site or somewhere else? It's just that it may be worth editing your question to include a link. All the best with getting a useful answer!
    – Monomeeth ♦
    Commented Aug 27, 2019 at 4:26
  • No idea what is that but just wanted to say that I noticed the same issue and also around the last few days. Here's an email with headers that I'm getting into my GMail inbox anonymized (my IP replaced with 1.1.1.1 and my addresses replaced as well): gist.github.com/nikita2206/909904d2e738158b0fb06a1ab990befe Headers say that this email was sent from 17.58.6.57 which belongs to Apple but there's that at least: projecthoneypot.org/ip_17.58.6.57
    – nikita2206
    Commented Aug 27, 2019 at 10:21
  • This is not really an answer but as a new user I can’t comment. I’m having the same issue with Apple Mail, but woth an Exchange server rather than iCloud. What’s notable is that the spam emails have a header that includes "Mime-Version: 1.0 (Mac OS X com.apple.MailServiceAgent 11.0 (3445.104.11))" whereas regular emails sent from the same Mac to the same gmail account have “MIME-Version: 1.0 (Mac OS X Mail 12.4 (3445.104.11))” ...
    – Servicedepartment
    Commented Aug 28, 2019 at 1:35
  • ...Also, the From: header is formatted somewhat differently — Lastbame, Firstname v. Firstname Lastname in case that’s somehow a clue to anyone. Couldn’t find any suspicious software with EtreCheck or MalwareBytes or Sophos. No more emails since this morning, so that’s good, but really hoping someone has some insight into this really strange behavior.
    – Servicedepartment
    Commented Aug 28, 2019 at 1:35

1 Answer 1

Reset to default
4

I believe I've figured this out. This is the well known Gcal spam, but in my case, at least, and I assume @derpymcderpson's case, the Google calendar is linked to Calendar.app (formerly iCal). That means that an email alarm from Calendar when the Gcal spam is added sends an email from your primary email account using Apple Mail (or, more specifically, MailServiceAgent). No hacking. Just unfortunate behavior. It's also, fortunately, why it only goes to your own Gmail account.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .