AnonyMousKIT phishing-as-a-service uses AI voice calls to steal iPhone passcodes

AnonyMousKIT phishing-as-a-service uses AI voice calls to steal iPhone passcodes A phishing-as-a-service (PhaaS) platform called AnonyMousKIT is automating the theft of Apple ID credentials needed to remove Activation Lock from stolen iPhones, SOCRadar found. “By leveraging a critical flaw – the use of bare relative paths – the investigation unraveled a reseller supply chain of 506 domains and 168 storefront brands active since early 2024. Despite leveraging advanced AI to mimic ‘Apple Support,’ basic coding errors exposed production logs and operator rosters,” researchers wrote. Researchers recovered 200 call logs and 55 transcripts from voice agents used to contact victims by phone. Of the 200 calls, 179 went to Brazil. The calls cost $19.24 in total. The platform had five voice-agent personas configured in English, Spanish, and Brazilian Portuguese. Three used the name “Alice Dias, Apple Support.” Apple’s Activation Lock, introduced in iOS 7, ties an iPhone to its owner’s Apple ID the moment Find My is turned on. Even after a factory reset, the device stays locked to that account and needs a valid login before it can be set up again. That protection is why stolen iPhones get sold for parts unless someone can get the owner’s credentials. That gap created what SOCRadar calls “a specialized, pay-per-action phishing platform designed to monetize stolen devices,” built for thieves who don’t have the skill to bypass Activation Lock themselves and would rather pay for someone else’s credential harvesting. Phishing the owners of stolen iPhones A subscriber enters a stolen device’s serial number or IMEI, and the platform pulls the model and live Find My status. It uses information associated with the stolen device to contact its owner by email, SMS, WhatsApp, a recorded call, or a voice agent. AnonyMousKIT attack lifecycle (Source: SOCRadar) “Targeting focuses on recent victims of Apple device loss or theft. Contacting them during active searches increases social engineering success by exploiting real circumstances and accurate hardware data,” researchers noted. The phishing messages tell victims their device has been found and ask them to verify their identity to get it back. In call transcripts reviewed by SOCRadar, a persona calling itself “Alice from Apple Support” tells victims someone tried to bring the phone into an Apple store to unlock it, so the store is holding it for security reasons. The voice agent follows a predefined conversation flow. It opens by confirming ownership of the device and asking the victim to dictate their four- or six-digit passcode. Once that’s captured, it shifts into a story built around the victim’s device model, claiming someone tried to unlock it in an Apple store and that the store opened a recovery case. It then checks whether the victim received a text with a security link, resending it if they say no, and talks them through entering the unlock code from that link. Once the code is confirmed, the agent ends the call. The stolen credentials can then be used to remove Activation Lock and prepare the device for resale. AnonyMousKIT remains active SOCRadar’s report splits the operation into tiers: a developer who builds and sells the platform, buyers who license it to run their own branded storefronts, and operators underneath them who send the phishing messages. “AnonyMousKIT is best understood not as a phishing kit but as a small software business with a criminal customer base,” SOCRadar added. According to researchers, AnonyMousKIT was still active on the last day of the investigation, with plans to continue tracking the platform and storefronts sharing its code.