Suspicious iCloud panel in System Preferences

[AppleTube]

I've been getting some odd issues with pop-ups about my iCloud login on my iMac while working.

After reading some info, it seems the TS steps were to sign out of the control panel, reboot, then re-sign back in. But now I'm seeing something even more suspicious.

"Enter the password for you use to unlock iMac" [sic]

I did not make a typo here, this is the exact spelling. Is it normal for Apple now to word their sentences like some typical fraudster in China using a typical google translator to english, or am I over paranoid and it's just their bad attempt at grammar?

If my panel was compromised, that could explain a few things.

 

[dianeoforegon]

This is normal now to have to enter your Mac pw again as an added layer of security.

 

[AppleTube]

I understand that, but where I am puzzled is why the horrible grammar that just screams of typical phishing here. Is this really how the prompt is supposed to come up?

I've been suspect if part of the control panel was altered by a 3'rd party. Wanted some clarification here.

 

[Shadow Jolteon]

That is pretty funny, it appears that they likely made a typo in the title of that message and nobody caught it. You could let them know via the macOS feedback page. The message you're seeing usually pops up if your computer's password changes in an unusual way, such as through Terminal or the password reset function in the recovery partition.

If you're still suspicious about the preference pane, I would run a quick scan with your preferred anti-malware software before proceeding.

 

[AppleTube]

Hey Shadow. I am just curious, is this the exact wording on your screen too if you have tested it?

I am mostly looking for confirmation from others to see if they've got the same horribly written pop-up or not.

Every single time I've seen something like this, it's always been part of a phishing ploy.

 

[NoBoMac]

You've got something suspicious going on as the iCloud sign-in screen has your Apple ID email and a password box. And when OSX asks for login id information, they have the standard two entry box screen (your Mac id ["John Q Public"] and blank box for password).

Do not enter anything there as you might have downloaded and installed some software that is trying to access your Keychain, for example.

Download Malwarebytes and see what's what.

The only thing I can think of where this MIGHT be legit is if the user account is old (read: created back around Mavericks era) and was originally setup to use your Apple ID password to sign-in to the Mac. Apple only allowed that option/function for a few months before being disabled, so, if newish account, that should not be possible. And even then, all iCloud functions are id/password pair sign-in, not just a password.

So, all said, think some phishing scam going on: do the malware scan.

 

[AppleTube]

Well too late now, I already signed in.

Did the malware scan, didn't find anything. But I guess it's time to just do a full re-format and re-install of the OS... I can't trust anything at this point I guess.

 

[dianeoforegon]

I would try testing in a new User first before you do a reinstall.

CREATE A NEW USER

Go to System Preferences --> Create a New User in Users & Groups.
Switch to the New User by logging out/in or use Fast User Switching.

 

[Shadow Jolteon]

Hey Shadow. I am just curious, is this the exact wording on your screen too if you have tested it?

I am mostly looking for confirmation from others to see if they've got the same horribly written pop-up or not.

Every single time I've seen something like this, it's always been part of a phishing ploy.

Actually, my husband just happened to try signing into iCloud on his laptop yesterday and had this screen up when he was showing me something, and I figured out what your problem and the grammar issue is. The message is supposed to read "Enter the password you use for Your Name you use to unlock Computer Name", however it looks like your name could not be found, and that your computer name is just set as "iMac".

The message is completely normal, and this message is either to verify your sign in to iCloud, or update your password on iCloud if you have the option to reset/sync your password with iCloud enabled. It was something added in macOS High Sierra and iOS 11. I had to enter these frequently on iPhones and laptops for work, since we used one Apple ID for everything. Thankfully, we've moved over to an MDM solution since then.

 

[dianeoforegon]

Change name in System Preferences > Sharing.

 

[Tech198]

I understand that, but where I am puzzled is why the horrible grammar that just screams of typical phishing here. Is this really how the prompt is supposed to come up?

I've been suspect if part of the control panel was altered by a 3'rd party. Wanted some clarification here.

So you think the wording (if not done the same structure as previous OS), its automatically an attack? hardly... It could be just Apple making it more clearer for users to understand what they need to do.

iTunes does that all the time as well, but i wouldn't call that a phishing attack,, more like a change.

 

[colodane]

Most likely just a coincidence, but I experienced something a little similar yesterday (14 April).

Got some error messages (not the exact one the OP reported) saying that some of the preference panes in the System Preferences could not be opened because of need for AppleID. This was blocking my eMail among other things.

It had been a couple months since I had restarted my iMac and it had been showing signs of slowing down. Had been thinking of a restart anyhow, so went ahead and did it yesterday. The restart allowed me to reenter my AppleID and since then everything has been working fine.

I'm also running Sierra.