# Apple Hide My Email Flaw Exposed Real Email Addresses via Spam-Filter/Bounce Triggering

> A privacy flaw in Apple iCloud+ 'Hide My Email' allowed an attacker who already knew a target's masked alias to unmask the underlying real email address by sending a message engineered to be rejected as spam, which caused the real address to surface in mail transfer/bounce (NDR) logs even though the message never reached the inbox. Independent researchers Tyler Murphy and Ben Weiner of EasyOptOuts privately reported the issue to Apple on June 13, 2025; Apple claimed fixes in March 2026 and again in mid-2026 that did not actually resolve the flaw, and only shipped a working patch on July 3, 2026 after 404 Media prepared to publish.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1628
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-hide-my-email-spam-bounce-unmasking-tl-2026-1628.webp?v=3f218762 (Threadlinqs threat intel: Hide My Email Spam-Filter Unmasking: Detection & IOCs (TL-2026-1628) — Critical severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1628
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

Hide My Email is a paid Apple iCloud+ feature that generates randomized alias addresses (typically two words plus a number at an @icloud.com-style domain) so users can sign up for services or receive correspondence without exposing their real email address. Researchers Tyler Murphy and Ben Weiner (co-founders of EasyOptOuts) discovered that Apple's mail-handling infrastructure leaked the underlying real address associated with a Hide My Email alias whenever a message sent to that alias was rejected by spam filtering and generated a bounce/non-delivery report. The real address appeared in mail transfer logs and bounce-processing artifacts maintained by email providers/hosts (including third-party mail hosting providers outside Apple's own infrastructure), regardless of whether the triggering message was malicious or a legitimate message that simply tripped spam heuristics. The affected messages typically never reached the victim's inbox or spam folder, so victims had no way to review whether they had been targeted. In limited volunteer testing, the researchers reported that 100% of tested Hide My Email addresses were successfully unmasked. The attack requires the attacker to already know the target's masked alias address, which limits (but does not eliminate) the practical attack surface, since Hide My Email aliases are routinely shared with third-party services, marketers, and correspondents, and an exposed real address can subsequently be correlated with personal details via free, publicly accessible people-search sites. Murphy reported the flaw to Apple on June 13, 2025, including replication instructions. Apple acknowledged the report in July 2025 and said it was investigating. In March 2026 Apple told Murphy the issue had been fixed; testing showed it had not. In May 2026 Apple stated the issue remained under investigation and a fix was expected 'in the coming weeks.' By late June 2026 the researchers remained unconvinced a real fix was forthcoming and brought the issue to 404 Media journalist Joseph Cox, who prepared coverage without publishing exploitation details in order to avoid enabling abuse. Apple deployed what both the company and the researchers describe as a working fix on July 3, 2026. 404 Media and other outlets published public disclosure of the flaw's existence (without exploit specifics) between July 17-22, 2026. Because the underlying mechanism relied on server-side mail transfer/log behavior rather than a client-side bug, any Hide My Email alias created and used before roughly July 7, 2026 may have already had its real address exposed and captured in third-party mail logs outside Apple's control, meaning the July 3 patch does not retroactively remediate addresses already leaked. Apple separately faces a class-action lawsuit alleging false advertising, fraud, and breach of contract tied to deceptive marketing of Hide My Email's privacy guarantees while the flaw went unfixed for over a year after private disclosure; some coverage characterized the suit as an early, largely evidence-free filing. No CVE or CVSS score has been assigned to this issue by any tracked authority as of publication; severity here is scored on real-world consumer-privacy impact given the reported 100% real-world de-anonymization success rate and the year-plus remediation delay including two false vendor 'fixed' claims, not on a CVSS/KEV/PoC criterion.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1598 Phishing for Information
- T1598.001 Spearphishing Service
- T1596 Search Open Technical Databases
- T1596.005 Scan Databases
- T1591 Gather Victim Org Information
- T1585 Establish Accounts
- T1585.002 Email Accounts
- T1586 Compromise Accounts
- T1586.002 Email Accounts
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1114 Email Collection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Bounce/NDR Log Contains Real Address Alongside Masked Alias Recipient** (`TL-2026-1628-SPL-001`)

Detects mail-transport bounce/non-delivery-report (NDR) log entries that carry a secondary/real recipient address field alongside a masked alias-style recipient for the same rejected delivery attempt — the root-cause CWE-200 log-leak pattern reproduced in this threat's Hide-My-Email bounce-processing exploitation and corrected by Apple's 2026-07-03 server-side patch. Fires on the mail gateway/MTA at the moment the vulnerable bounce is generated, before any downstream correlation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1589.002, T1598.001
- **Data sources:** mail_transport_logs, mta_bounce_ndr_logs, email_gateway_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=mail_transport sourcetype IN ("postfix:bounce","exim:reject","sendmail:bounce") ("550 5.7.1" OR "rejected as spam" OR "spam filtering")
| rex field=_raw "orig_rcpt=(?<orig_rcpt>[^\s]+)"
| rex field=_raw "(real_rcpt_leak|leaked_real_rcpt|secondary_recipient|X-Sim-Leaked-Real-Address)[:=]\s*(?<leaked_real_addr>[^\s;]+)"
| where isnotnull(leaked_real_addr) AND leaked_real_addr!="REDACTED" AND match(orig_rcpt, "^[a-z]+-[a-z]+[0-9]{2,4}@")
| eval alias_recipient=orig_rcpt
| stats count min(_time) as first_seen max(_time) as last_seen by mta_host, sender, alias_recipient, leaked_real_addr
| where count > 0
| table first_seen, last_seen, mta_host, sender, alias_recipient, leaked_real_addr, count
| sort -last_seen
```

### Microsoft KQL

```kql
let SuspiciousBounceLeak = EmailEvents
| where Timestamp > ago(24h)
| where DeliveryAction == "Bounced" or DeliveryReason has_any ("550 5.7.1", "RejectedAsSpam", "rejected as spam")
| where RecipientEmailAddress matches regex @"^[a-z]+-[a-z]+[0-9]{2,4}@"
| extend LeakedRealAddress = extractjson("$.leaked_real_rcpt", AdditionalFields)
| where isnotempty(LeakedRealAddress) and LeakedRealAddress != "REDACTED"
| project Timestamp, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, LeakedRealAddress, DeliveryReason;
SuspiciousBounceLeak
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), LeakCount=count() by SenderFromAddress, RecipientEmailAddress, LeakedRealAddress
| order by LastSeen desc
```

### Sigma

```yaml
title: Mail Bounce/NDR Log Contains Unexpected Secondary Recipient Address
id: 6e2b6a2e-8f3d-4c2a-9b1a-b6a1e9c4d001
status: experimental
description: Detects a mail-transfer bounce/NDR log entry for an alias-style recipient that also exposes a real/underlying recipient address, reproducing the Apple Hide My Email CWE-200 de-anonymization flaw (patched 2026-07-03).
references:
    - https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/
    - https://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-22
tags:
    - attack.reconnaissance
    - attack.t1589.002
    - attack.t1598.001
    - cve.2026.hide-my-email
cwe: CWE-200
logsource:
    category: application
    product: mail
detection:
    selection_bounce:
        message|contains:
            - '550 5.7.1'
            - 'rejected as spam'
    selection_leak:
        additional_recipient_field|exists: true
    selection_alias:
        recipient|re: '^[a-z]+-[a-z]+[0-9]{2,4}@.*'
    condition: all of selection_*
falsepositives:
    - Legitimate secondary-recipient headers used for internal routing or shared-mailbox delivery
    - Mail hosts that intentionally log a distribution-list expansion address alongside an alias
level: high
```

**Known false positives:**

- Legitimate internal mail-routing configurations that intentionally log a secondary/expansion recipient alongside an alias for shared-mailbox or distribution-list delivery

**Tuning notes:** Scope the alias-recipient regex to the organization's actual masked-alias domain/naming convention (e.g. the two-word+number @icloud-alias pattern) rather than the generic pattern shown, and whitelist known internal expansion-header mail flows to reduce false positives before enabling auto-alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Exchange Online / M365 Defender: Bounce Event Exposes Real Recipient Behind Masked Alias (locked: unlock with TL Creds)
- Sentinel: Repeated High-Spam-Score Probes Against Registered Alias Mailboxes (locked: unlock with TL Creds)
- Sentinel: Compromised/Newly-Established Account Exfiltrating Alias-to-Real-Address Mappings to External Correlation Services (locked: unlock with TL Creds)
- Mail Bounce/NDR Log Contains Unexpected Secondary Address Pattern (locked: unlock with TL Creds)
- High-Volume Spam-Triggering Probes to Known Alias-Style Recipients (locked: unlock with TL Creds)
- Spearphishing-Service Alias Abuse Followed by Real-Address Correlation Lookup (locked: unlock with TL Creds)
- Burst of Spam-Triggering Probe Messages Targeting Alias-Style Recipients (locked: unlock with TL Creds)
- Post-Leak Correlation: Newly-Exposed Real Address Queried Against People-Search Sources (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Apple Released Fixes For Hide My Email Flaw](https://cybersecuritynews.com/apple-released-fixes-for-hide-my-email-flaw/)
- [Apple Fixes Hide My Email Vulnerability After 404 Media Coverage](https://www.404media.co/apple-fixes-hide-my-email-vulnerability-after-404-media-coverage/)
- [Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs](https://thehackernews.com/2026/07/apple-fixes-hide-my-email-bug-that.html)
- [Apple Patches Hide My Email Flaw More Than a Year After It Was Reported](https://www.macrumors.com/2026/07/21/apple-patches-hide-my-email-flaw/)
- [Apple Hide My Email Vulnerability Exposes Real Email Addresses](https://www.macrumors.com/2026/07/01/hide-my-email-vulnerability-exposes-real-addresses/)
- [Apple finally patches Hide My Email flaw after one year](https://www.neowin.net/news/apple-finally-patches-hide-my-email-flaw-after-one-year/)
- [It's too easy to find the real address behind Apple's Hide My Email](https://appleinsider.com/articles/26/07/17/its-easy-to-find-a-real-email-address-behind-hide-my-email-but-it-doesnt-really-matter)
- [Apple fixes Hide My Email bug that exposed users' real email addresses](https://www.digitaltrends.com/computing/apple-fixes-hide-my-email-bug-that-exposed-users-real-email-addresses/)
- [Apple Patches Hide My Email Flaw More Than a Year After It Was Reported - iClarified](https://www.iclarified.com/101538/apple-patches-hide-my-email-flaw-more-than-a-year-after-it-was-reported)
- [Apple Finally Patches the 'Hide My Email' Flaw (But Is the Damage Done?)](https://www.idropnews.com/news/apple-patches-hide-my-email-flaw/266540)
- [Apple Patches Hide My Email Flaw More Than a Year After It Was Reported - MacRumors Forums](https://forums.macrumors.com/threads/apple-patches-hide-my-email-flaw-more-than-a-year-after-it-was-reported.2485726/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1628