AnonyMousKIT phishing platform steals Apple IDs to unlock stolen iPhones
AnonyMousKIT is a phishing-as-a-service platform discovered by SOCRadar that uses AI-generated voice calls and spoofed Apple pages to steal credentials from owners of lost iPhones, enabling theft and resale of the devices. Operating since 2024 with over 500 domains, it targets victims searching for lost devices and harvests Apple IDs and two-factor authentication codes across multiple channels.
What happened
Security researchers at SOCRadar discovered AnonyMousKIT, a phishing-as-a-service platform active since 2024 that targets stolen iPhones to bypass Apple's Activation Lock security feature.
The platform operates 500+ domains and uses AI-generated voice calls, spoofed Find My pages, email, text messages and WhatsApp to trick victims into providing Apple ID credentials and two-factor authentication codes.
Reported impact
Stolen iPhones unlocked through the platform enable attackers to access victims' Apple accounts and personal data, with devices subsequently resold.
Index analysis
The system combines multiple social engineering vectors including AI-driven voice calls posing as Apple Support alongside traditional phishing messages, operating as a commercial criminal service with 500+ registered domains.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.