I ALMOST LOST MY APPLE ACCOUNT TO THE MOST SOPHISTICATED PHISHING ATTACK I'VE EVER SEEN

Summary from the TLDR InfoSec newsletter

A security-conscious user received several 2FA prompts and SMS verification codes for their Apple account one afternoon, followed by an automated call warning them that their account was under attack. After receiving this call, a second call came from a very professional-sounding employee who created a support case for the user, verified that it was from Apple to build trust, and walked the user through resetting their password. The phish then had the user “close the case” via an SMS link, which directed them to a sophisticated phishing site where they could steal the user's credentials.