Apple Knowledge Base 204106 addresses this.

There have been similar phishing scams but this does not appear to have any of the characteristics of a common phishing exploit.

If we knew what it was we were doing, it wouldn't be called research, would it?

— Albert Einstein