A security researcher has published attack code he said makes it easy to steal the iCloud passwords of people using the latest version of Apple iOS for iPhones and iPads.

The proof-of-concept attack exploits a flaw in Mail.app, the default iOS e-mail program. Since the release of version 8.3 in early April, the app has failed to properly strip out potentially dangerous HTML code from incoming e-mail messages. The proof-of-concept exploit capitalizes on this failure by downloading a form from a remote server that looks identical to the legitimate iCloud log-in prompt. It can be displayed each time the booby-trapped message is viewed.

"This bug allows remote HTML content to be loaded, replacing the content of the original e-mail message," a user with the GitHub name jansoucek wrote in a readme file accompanying the exploit. "JavaScript is disabled in this UIWebView, but it is still possible to build a functional password 'collector' using simple HTML and CSS [cascading style sheets]."

To reduce suspicion that anything is amiss, the exploit can be programmed to display the password prompt only once, rather than each time the malicious message is viewed. To make it mimic the legitimate prompt Apple uses to authenticate iOS users, the attack code uses a feature known as autofocus to hide the dialog field once a user clicks OK. All that's required to trigger the vulnerability is an e-mail with the <meta http-equiv=refresh> HTML tag sent to the target and an Internet-connected computer that hosts the fake login prompt. The internal browser in the Apple mail app will then embed the image in the e-mail in a way that could easily fool some people. Besides being used to phish people's passwords, the iOS weakness could be used to send "beacons" that let senders know who has viewed e-mail, when it was viewed, and from what Internet address.

Here's a video of the attack in action:

Errata Security CEO and longtime iPhone user Rob Graham said he considered the vulnerability serious, because it's not uncommon for iOS to display login prompts at unexpected times. He told Ars he had received one such prompt earlier Wednesday, a few hours before reading of the weakness. He said the best thing users can do when encountering such a prompt is to press the cancel button without entering any login credentials. Most of the time users will face no ill consequences, and the worst that can happen is they will be prompted again. When users do enter their password into the box, they should make sure they do so when no e-mails are displayed.

More experienced users will be able to detect a fake prompt by hitting the home button when it's displayed. Legitimate prompts are "modal," meaning they won't allow a user to do anything else until either the OK or cancel buttons are pushed. The fake prompt, by contrast, is not modal. If pressing the home button while a prompt is displayed returns a device to the main screen, the prompt is a hoax that shouldn't be trusted.

The researcher said he reported the bug to Apple in January but that Apple has so far declined to provide a fix. Apple has yet to provide any comment on the vulnerability, but it wouldn't be surprising to see a fix available in version 8.4, or very possibly an incremental release.

Update: In an e-mailed statement, Apple officials wrote: "We are not aware of any customers affected by this proof of concept, but are working on a fix for an upcoming software update." Additionally, Apple has long recommended users activate two-factor authentication.