I'm Warden, Head of Trust & Safety. This is a standing thread. Every claim below links to a source and carries the date I last checked it: 11/11/2026. When I verify a new scam pattern, I edit it in here with a date. Free to read, no login needed.
1. The one rule
Never type your Apple Account password or a verification code into a web page, message or pop-up that someone sent you. Apple says so directly: it "will never ask you to log in to any website, or to tap Accept in the two-factor authentication dialog, or to provide your password, device passcode, or two-factor authentication code or to enter it into any website." Scammers typically send you to a fake page that looks like a real Apple sign-in and insist you verify your identity.
Apple updated that page on 06/15/2026. It now also lists two more things scammers ask for: that you turn off two-factor authentication or Stolen Device Protection ("Apple will never ask you to disable any security feature on your device or on your account"), and that you paste a command or script into Terminal on a Mac.
Source: Apple Support, "Recognize and avoid social engineering schemes", published 06/15/2026
2. What about sideloading tools that do ask for your Apple ID?
Tools you run yourself, such as AltServer or Sideloadly, ask for an Apple ID because that is how they sign apps. AltStore's own install guide says your Apple ID and password "are sent only to Apple, not us or anyone else." That is the project's claim about its own software, and it only holds for the real software. The risk is a lookalike: a fake download page, or a message that tells you to sign in somewhere. Our own suggestion, not an Apple requirement: sign in to sideloading tools with a secondary Apple Account, not the one that holds your photos and purchases.
Source: AltStore FAQ, Windows install
3. Fake downloads of the tools
Get a sideloading tool only from its official site or repository. A consumer-tech guide (WhistleOut) warns that fake Sideloadly sites exist to steal data; this is a secondary source, so treat it as a reason to check the address, not as a count of how common it is. If you reached the download from a video description, a search ad or a DM, go to the project's own site by typing it yourself.
Source: WhistleOut guide
4. Fake Apple pop-ups inside an app you installed
In May 2024, Jamf Threat Labs described attackers using sideloaded apps to draw alerts that copy genuine iOS prompts, so people type in their credentials without thinking. A password prompt that appears inside an app is not Apple. Close the app and sign in only through the Settings app. Jamf also noted that in Settings > General > iPhone Storage, sideloaded apps do not show a developer name and lack the "Offload App" option, which is one way to tell them from App Store installs (their 2024 observation; iOS can change this).
Source: Jamf Threat Labs, 05/30/2024
5. App sites are where the malware is
In March 2024, security firm Netcraft downloaded 350 apps from 20 popular third-party iOS app sites. 14 of them (about 5%) appeared malicious, and it found over 1,000 instances of apps impersonating brands such as YouTube, Instagram and WhatsApp. Limits on this number: it is a security vendor's sample, from 2024, of third-party marketplaces, not a measure of AltStore or Sideloadly themselves, and Netcraft notes malware has also been found in the official App Store. The takeaway is narrow: an app from a random site is an unknown, and "it installed fine" proves nothing about what it does afterward. This forum does not host or link cracked or pirated apps (Community Rules, rule 2).
Source: Netcraft, 03/06/2024
6. If you already entered your password or a code
Change your Apple Account password straight away, from the Settings app or Apple's own site. Apple's steps for a suspected compromise start there and then walk you through checking which devices and which Apple Account are signed in.
Source: Apple Support, "If you think your Apple Account has been compromised"
7. Reporting
- On this forum: use the Report button under the post (Community Rules, rule 3 covers scams, malware, phishing and fake giveaways). I review reports and every action comes with a reason and an appeal route.
- Phishing emails or texts pretending to be Apple: Apple asks you to forward them to [email protected].
- Discord and Telegram: message staff in the channel. Do not click the link to check it.
What this thread will not do
It will not say a named tool, site or rival community is malware without a source you can open. If you have a suspicious link, post it with the dots written as "[dot]" so nobody clicks by accident, say where you got it, and I will check it. If it checks out, it goes in this thread with a date and a source. If it does not, I will say that too.
What scam have you actually run into while sideloading? Reply with what happened, minus any passwords or codes.
Warden, Head of Trust & Safety | last checked 11/11/2026 | updated 11/11/2026: Apple's 06/2026 changes added to section 1; sections 8-12 are in the next post
1. The one rule
Never type your Apple Account password or a verification code into a web page, message or pop-up that someone sent you. Apple says so directly: it "will never ask you to log in to any website, or to tap Accept in the two-factor authentication dialog, or to provide your password, device passcode, or two-factor authentication code or to enter it into any website." Scammers typically send you to a fake page that looks like a real Apple sign-in and insist you verify your identity.
Apple updated that page on 06/15/2026. It now also lists two more things scammers ask for: that you turn off two-factor authentication or Stolen Device Protection ("Apple will never ask you to disable any security feature on your device or on your account"), and that you paste a command or script into Terminal on a Mac.
Source: Apple Support, "Recognize and avoid social engineering schemes", published 06/15/2026
2. What about sideloading tools that do ask for your Apple ID?
Tools you run yourself, such as AltServer or Sideloadly, ask for an Apple ID because that is how they sign apps. AltStore's own install guide says your Apple ID and password "are sent only to Apple, not us or anyone else." That is the project's claim about its own software, and it only holds for the real software. The risk is a lookalike: a fake download page, or a message that tells you to sign in somewhere. Our own suggestion, not an Apple requirement: sign in to sideloading tools with a secondary Apple Account, not the one that holds your photos and purchases.
Source: AltStore FAQ, Windows install
3. Fake downloads of the tools
Get a sideloading tool only from its official site or repository. A consumer-tech guide (WhistleOut) warns that fake Sideloadly sites exist to steal data; this is a secondary source, so treat it as a reason to check the address, not as a count of how common it is. If you reached the download from a video description, a search ad or a DM, go to the project's own site by typing it yourself.
Source: WhistleOut guide
4. Fake Apple pop-ups inside an app you installed
In May 2024, Jamf Threat Labs described attackers using sideloaded apps to draw alerts that copy genuine iOS prompts, so people type in their credentials without thinking. A password prompt that appears inside an app is not Apple. Close the app and sign in only through the Settings app. Jamf also noted that in Settings > General > iPhone Storage, sideloaded apps do not show a developer name and lack the "Offload App" option, which is one way to tell them from App Store installs (their 2024 observation; iOS can change this).
Source: Jamf Threat Labs, 05/30/2024
5. App sites are where the malware is
In March 2024, security firm Netcraft downloaded 350 apps from 20 popular third-party iOS app sites. 14 of them (about 5%) appeared malicious, and it found over 1,000 instances of apps impersonating brands such as YouTube, Instagram and WhatsApp. Limits on this number: it is a security vendor's sample, from 2024, of third-party marketplaces, not a measure of AltStore or Sideloadly themselves, and Netcraft notes malware has also been found in the official App Store. The takeaway is narrow: an app from a random site is an unknown, and "it installed fine" proves nothing about what it does afterward. This forum does not host or link cracked or pirated apps (Community Rules, rule 2).
Source: Netcraft, 03/06/2024
6. If you already entered your password or a code
Change your Apple Account password straight away, from the Settings app or Apple's own site. Apple's steps for a suspected compromise start there and then walk you through checking which devices and which Apple Account are signed in.
Source: Apple Support, "If you think your Apple Account has been compromised"
7. Reporting
- On this forum: use the Report button under the post (Community Rules, rule 3 covers scams, malware, phishing and fake giveaways). I review reports and every action comes with a reason and an appeal route.
- Phishing emails or texts pretending to be Apple: Apple asks you to forward them to [email protected].
- Discord and Telegram: message staff in the channel. Do not click the link to check it.
What this thread will not do
It will not say a named tool, site or rival community is malware without a source you can open. If you have a suspicious link, post it with the dots written as "[dot]" so nobody clicks by accident, say where you got it, and I will check it. If it checks out, it goes in this thread with a date and a source. If it does not, I will say that too.
What scam have you actually run into while sideloading? Reply with what happened, minus any passwords or codes.
Warden, Head of Trust & Safety | last checked 11/11/2026 | updated 11/11/2026: Apple's 06/2026 changes added to section 1; sections 8-12 are in the next post
Last edited by a moderator:
