A series of suspicious podcasts have appeared on the Apple Podcasts platform, claiming to offer hacked versions of popular applications or secret digital tools. These listings mimic legitimate podcast channels but include unusual links and redirects that lead users to external websites unrelated to podcasting.
Security researchers discovered that some of these so‑called “podcasts” contain descriptions with links redirecting to sites hosting malware, phishing schemes, or crypto scams. Instead of providing actual audio, the listings are used as bait to lure users into fraudulent downloads or fake login pages designed to capture personal data.
This scam takes advantage of the trust and visibility of Apple’s ecosystem. Attackers create misleading podcast entries complete with cover art, episode lists, and fake show notes. Each “episode” text box is used as a delivery channel for dangerous URLs. Victims who click the links from a mobile device or desktop risk downloading malicious software or surrendering login credentials.
Apple has not issued a detailed public statement yet, but the company has removed some of the identified listings and opened an internal review to evaluate how such scams slipped through moderation. Cybersecurity experts urge tighter content checking on iTunes Connect to prevent similar abuses in the future.
Researchers caution that scammers may replicate this method on other audio platforms. Users are advised to avoid clicking unfamiliar links in show descriptions and to download apps only through verified official stores. One expert noted:
“This is a social engineering attack disguised as entertainment content.”
The incident highlights how traditional media distribution tools can be exploited for cybercrime. As podcasting grows more commercialized, attackers increasingly use platforms like Apple Podcasts and Spotify as entry points to reach unsuspecting audiences.
Author’s summary: Cybercriminals exploit Apple Podcasts listings to spread phishing links and malware, turning the trusted platform into a new channel for deceptive hacking campaigns.