Underground Market Uses Smishing Kits to Unlock and Resell Stolen iPhones
Summary
Researchers traced an underground Telegram marketplace selling iPhone-unlocking and smishing tools. DNS analysis identified more than 10,000 associated domains, with traffic to verified campaign domains rising 350% in 2025 versus 2024.
Key points
- Thieves use personalized texts and Apple-lookalike phishing pages to trick owners of stolen iPhones into entering their passcodes and Apple Account credentials.
- Telegram sellers offer unlocking software, phishing kits, social-engineering scripts, and bots that can retrieve device and owner information.
- After credentials are captured, attackers use them to remove linked devices from the victim’s Apple Account and unlock phones for resale.
- Researchers found more than 10,000 associated domains; traffic to verified smishing domains increased 350% in 2025 compared with 2024.
- Some tools check whether domains are blocked by Google Safe Browsing and automatically submit appeals using fabricated justifications.
- The researchers say the tools generally wipe devices after access, indicating that resale value—not the data stored on phones—is the main motive.
Article Details
- Attack Vectors
- Smishing messages sent to contact details displayed on stolen iPhones direct owners to personalized phishing pages that imitate Apple Find My and ask for the device passcode or Apple Account credentials.
- Stolen-device information, including serial number, original activation country, linked Apple Account, victim name, email, and passcode length, is used to personalize phishing messages and pages.
- Phishing kits return victims’ entered credentials to attackers via Telegram; the credentials are then used to remove linked devices from the Apple Account.
- Social-engineering scripts, AI voice-calling software, and pre-recorded multilingual audio impersonate Apple and ask owners for passcodes.
- Unlocking tools can jailbreak older iPhones and extract identifying information; the article says tools wipe devices by default after access is attained.
- Defensive Notes
- Do not enter an iPhone passcode or Apple Account credentials on a link received in an unsolicited message claiming to locate or return a lost device.
- The article reports that some tools check whether smishing domains are blocked by Google Safe Browsing and submit deceptive delisting requests; it also states that most observed smishing domains were not blocked at the time of writing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apple-mylocation[.]info | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | apple[.]com-app[.]lt | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | apple[.]connect-app[.]info | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | applebrasil[.]info | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | applemap[.]us | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | applemaps-support[.]live | Phishing domain used in a smishing message to direct a stolen iPhone's owner to a passcode-stealing page. |
| DOMAIN | applesupporter[.]us | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | find[.]my-id[.]com[.]es | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | findyourphone[.]help | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | icloud-f[.]com | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | icloud[.]sa[.]com | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | locate-it-now[.]net | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | lphone-retained-store[.]us | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | mapsfind[.]info | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | navigate-to-location[.]me | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | phone[.]xuidns[.]pw | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | photos-sharing[.]in | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | smartthingsfind-samsung[.]com | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | support-lcloud[.]xyz | Listed as a phishing domain in the article's sample indicators. |
| DOMAIN | view-location[.]app | Identified as a customer-support-themed domain associated with the reported campaigns; the article's sample indicator list classifies it as phishing. |
MITRE ATT&CK
T1056.003 · Web Portal CapturePhishing pages imitate Apple Find My and prompt victims to enter credentials and device passcodes.T1566.002 · Spearphishing LinkSmishing messages send victims links to personalized phishing pages that request iPhone passcodes or Apple Account credentials.T1583.001 · DomainsThe article describes more than 10,000 campaign-associated domains, including lookalike and support-themed phishing domains.T1598.003 · Spearphishing LinkThe operators use personalized SMS messages and phishing pages to solicit device-owner credentials and passcodes.T1656 · ImpersonationScripts, AI voice-calling software, and prerecorded audio impersonate Apple to persuade owners to disclose passcodes.
People
Products
Apple AccountAn ‘FMI OFF’ (Find My iPhone Off) or ‘iCloud Webkit:’ a phishing and smishing kit designed to convince legitimate owners to forfeit their iCloud/Apple Account and screen lock passcode,Google ChromeBy querying a specific attacker-controlled endpoint hosting the list of smishing domains, and using a headless Chrome browser to attempt connection, the tools can automatically check if any domains have been blocked.Google Safe BrowsingIt seems like their phishing domains are often detected, and some of the tools sold in these forums contain mechanisms to detect DNS blocks and automatically request delisting from Google Safe Browsing.iOSAt the time of writing, the latest phone models and iOS versions above 17.0 are not affected by any publicly disclosed vulnerabilities enabling unauthorized access.iPhoneWhen somebody loses access to their iPhone, they can set a message on the locked screen, directing the finder to contact a specific phone number to return the device.SamsungBesides unlocking tools, developers have also created dozens of different smishing templates, as shown below in Figure 8, covering Apple but also other major brands like Xiaomi and Samsung.XiaomiBesides unlocking tools, developers have also created dozens of different smishing templates, as shown below in Figure 8, covering Apple but also other major brands like Xiaomi and Samsung.
Tools
Countries
BangladeshWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.BrazilWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.IndiaWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.MexicoWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.PakistanWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.United StatesFigures indicate over 7.35 million are stolen in the United States yearly.VenezuelaWe found sellers in Bangladesh, India, Pakistan, Venezuela, Mexico, Brazil, and other countries, as shown in Figure 6 below.