- Messages
- 4,007
- Likes
- 1,873
- Points
- 2,130
Security researchers at SOCRadar analyzed the phishing platform AnonyMousKIT, which helps criminals remove Activation Lock from stolen Apple devices. The service uses phishing pages and AI voice agents that call device owners, posing as Apple support agents, and trick them into providing a device unlock code, Apple ID credentials, and two-factor authentication codes.
AnonyMousKIT operates as a PhaaS (phishing-as-a-service) and has been active since at least early 2024. Its customers have access to subscriptions, credit packages, technical support, and multiple communication channels with victims: email, SMS, WhatsApp, recorded calls, and conversations with AI agents. The researchers linked AnonyMousKIT activity to 506 domains, 188 of which remained active at the time of analysis. Additionally, 168 separate resellers were discovered offering access to and unlocking services for stolen iPhones. AnonyMousKIT targets owners of recently lost or stolen iPhones. Attackers extract contact information left in Lost Mode from these devices , as well as information about the model, IMEI, and Find My status. The attackers then send the victim a message purportedly from Apple employees, claiming that the missing smartphone has been found. The link in the message leads to a fake Find My or Apple page, which even displays a map showing the device's location. The user is asked for a four- or six-digit unlock code, Apple ID credentials, and then a current two-factor authentication code. But AnonyMousKIT's AI voice agents deserve special attention. Experts were able to access the account data of the operator AnonyMousKIT on the commercial platform Vapi and discovered information on 200 calls made between August 31, 2025, and May 30, 2026. The calls used 55 different scripts and AI agents, which presented themselves to victims as "Alice from Apple Support" in English, Spanish, and Portuguese. Of the 200 calls, 179 were made in Brazil, and their total cost was only $19.24 (about 0.96 cents per attempt). In one script, the AI told the victim that someone had brought their iPhone to an Apple Store and attempted to remove the activation lock. The bot then asked the user to confirm ownership, provide an unlock code, and then redirect them to a phishing page. However, the researchers do not provide data on the percentage of successful attacks. All that is known is that in 100 cases the victims hung up, another 48 calls were automatically terminated due to silence on the other end of the line, 24 remained unanswered, and the remaining 28 ended with a platform error or a busy signal.
Having obtained the necessary codes, criminals are able to reset the device to factory settings, unlink it from Find My, and resell it. Researchers also note that compromising an Apple ID could have more serious consequences, as it would give attackers access to iCloud backups, Keychain passwords, work email, and other corporate data.
According to SOCRadar, the AnonyMousKIT infrastructure is used worldwide, but the platform is particularly active against users in South Africa, Indonesia, Italy, India, Kenya, and Brazil.
AnonyMousKIT operates as a PhaaS (phishing-as-a-service) and has been active since at least early 2024. Its customers have access to subscriptions, credit packages, technical support, and multiple communication channels with victims: email, SMS, WhatsApp, recorded calls, and conversations with AI agents. The researchers linked AnonyMousKIT activity to 506 domains, 188 of which remained active at the time of analysis. Additionally, 168 separate resellers were discovered offering access to and unlocking services for stolen iPhones. AnonyMousKIT targets owners of recently lost or stolen iPhones. Attackers extract contact information left in Lost Mode from these devices , as well as information about the model, IMEI, and Find My status. The attackers then send the victim a message purportedly from Apple employees, claiming that the missing smartphone has been found. The link in the message leads to a fake Find My or Apple page, which even displays a map showing the device's location. The user is asked for a four- or six-digit unlock code, Apple ID credentials, and then a current two-factor authentication code. But AnonyMousKIT's AI voice agents deserve special attention. Experts were able to access the account data of the operator AnonyMousKIT on the commercial platform Vapi and discovered information on 200 calls made between August 31, 2025, and May 30, 2026. The calls used 55 different scripts and AI agents, which presented themselves to victims as "Alice from Apple Support" in English, Spanish, and Portuguese. Of the 200 calls, 179 were made in Brazil, and their total cost was only $19.24 (about 0.96 cents per attempt). In one script, the AI told the victim that someone had brought their iPhone to an Apple Store and attempted to remove the activation lock. The bot then asked the user to confirm ownership, provide an unlock code, and then redirect them to a phishing page. However, the researchers do not provide data on the percentage of successful attacks. All that is known is that in 100 cases the victims hung up, another 48 calls were automatically terminated due to silence on the other end of the line, 24 remained unanswered, and the remaining 28 ended with a platform error or a busy signal.
Having obtained the necessary codes, criminals are able to reset the device to factory settings, unlink it from Find My, and resell it. Researchers also note that compromising an Apple ID could have more serious consequences, as it would give attackers access to iCloud backups, Keychain passwords, work email, and other corporate data.
According to SOCRadar, the AnonyMousKIT infrastructure is used worldwide, but the platform is particularly active against users in South Africa, Indonesia, Italy, India, Kenya, and Brazil.