iCloud users in China are the target of a “man in the middle” attack, most likely run by the Chinese state on connections passing into and out of the country, surveillance experts say.

The attack on the storage service began on Monday, the same day the iPhone 6 and 6 Plus were released in China for the first time. It intercepts data passed between the user and iCloud.com, Apple’s cloud computing service, by routing all communication between the two through a malicious third party.

Typically, iCloud.com employs the SSL internet security protocol to establish a secure connection. To get around that, the Chinese attacker has used a self-signed certificate, which is enough to trick users of insecure browsers into thinking they’ve accessed the iCloud website through a secure connection.

“This is clearly a malicious attack on Apple in an effort to gain access to usernames and passwords and consequently all data stored on iCloud, such as iMessages, photos, and contacts”, wrote the Chinese internet freedom organisation Great Fire. “If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities.

The organisation speculated that the attack “may also somehow be related again to images and videos of the Hong Kong protests being shared on the mainland.”

SSL, or Secure Sockets Layer, the protocol used to secure iCloud, relies on certificates signed by one of a number of trusted authorities to verify that the site being connected to isn’t intercepted by an eavesdropper. The attack made use of a self-signed certificate, which claims to be iCloud.com but isn’t supported by a trusted third party. Most modern secure browsers will reject such certificates, but notably, 360 Secure Browser, a popular browser developed by Chinese firm Qihoo, does not.

The “great firewall” is a notoriously imprecise censorship tool, frequently blocking sites on a piecemeal basis or allowing access for seemingly random periods of time, and the iCloud intercept is no different: the attack only occurs if users visit one particular IP address, meaning that it’s possible to simply reload the site and try again.

As well as running a secure browser which will reject self-signed certificates, one way users can stay safe against attacks like this is by enabling two-step verification on their accounts. That won’t stop any attacker seeing what the target looks at – the equivalent of browsing over their shoulder – but it does mean that if usernames and passwords are stolen, they can’t be used to gain access to the compromised account.

Apple declined to comment.