Attackers have created phishing sites to trick users whose iOS devices have been lost or stolen into handing over their iCloud credentials.