A Reddit user recently received an unsolicited iPhone 15 Pro Max delivered in a sealed retail box that the recipient had never ordered. The smartphone appeared brand new on the outside, yet verification of its serial number through Apple’s systems immediately raised red flags.
According to Apple’s records, the device had been purchased or activated as early as December 2023, and its warranty coverage had already expired in 2024. This timeline directly contradicts the pristine condition of the packaging, suggesting the phone inside may have been used or handled previously.
The shipment arrived with a FedEx shipping label, but the tracking number printed on the label could not be found in the carrier’s official tracking system. The recipient wisely chose not to power on the device, insert a SIM card, or link it to any personal network or Apple ID.
Community discussion on Reddit quickly turned to the possibility of a targeted cyber attack. Commenters speculated that an adversary might have sent a pre-modified handset as part of a whaling or spear-phishing operation aimed at extracting sensitive data or gaining access to high-value accounts once the phone was activated.
While the scenario resembles techniques sometimes associated with advanced targeted attacks, no definitive proof has emerged that the package was sent by malicious actors. It remains equally plausible that the delivery resulted from a logistics error, return fraud, or another non-security-related mix-up.
Security-conscious recipients of similar unsolicited devices are advised to leave the hardware powered off, avoid any network connections, and either submit it to Apple for forensic examination or recycle it through certified electronic-waste channels.
