Apple Account "Case ID" phishing panel behind a proof-of-work gate

Phishing campaign, active since at least June 2026, that registers Apple ID look-alike domains in two spellings: a word followed by -apple-id[.]com or -appleid[.]com, for example deny-apple-id[.]com, login-apple-id[.]com, settings-apple-id[.]com, signin-appleid[.]com or cases-appleid[.]com. A visitor first passes a browser check (a proof-of-work puzzle, a scoring of browser properties and sometimes a typed code); visitors that fail it see a fake "404 Not Found" page. The site then asks for a "Case ID", which suggests the victim is given one by someone posing as Apple support. After that, a human operator decides which page the victim sees next: fake Apple Account sign-in, passcode, two-factor, payment-card, billing, email or phone confirmation and "account on hold" pages. Everything typed is sent to the operator as it is typed, before the form is submitted, and the operator can redirect the victim at any time. Domains are registered a few at a time and many are suspended within days. A match means a page carrying the panel or its browser check, or a scan of a known campaign domain.