AnonyMousKIT PhaaS Uses AI Voice Calls to Phish iPhone Passcodes
Summary
SOCRadar says AnonyMousKIT, a PhaaS active since early 2024, uses fake Apple messages and AI voice agents to steal iPhone passcodes and Apple credentials, bypass Activation Lock, and access data. Researchers linked it to 506 domains and 168 reseller storefronts.
Key points
- SOCRadar linked AnonyMousKIT to 506 domains and 168 reseller storefronts.
- The platform targets stolen iPhones, using fake Apple alerts to direct owners to phishing pages for device passcodes, Apple Account credentials, and two-factor codes.
- SOCRadar researchers say voice AI agents used five personas; they recovered 55 call transcripts covering 200 calls between August 2025 and May 2026.
- About 90% of the recovered calls targeted people in Brazil, according to SOCRadar.
- The researchers say stolen-device contact details are used to reach owners by email, SMS, WhatsApp, or phone.
- Stolen credentials could expose iCloud backups, Keychain passwords, work email, and other personal or corporate information.
Article Details
- Event Type
- SOCRadar reported a phishing-as-a-service platform, AnonyMousKIT, that uses phishing messages and voice AI agents to obtain passcodes and Apple Account credentials associated with stolen iPhones.
- Impact
- The service is linked to 506 domains and 168 reseller storefronts. Obtained credentials and codes can enable access to victims’ personal data, including iCloud backups and Keychain credentials, and allow devices to be reset and removed from Find My before resale. SOCRadar reports that 90% of 200 recovered calls were made to victims in Brazil; it also says the campaigns had a global footprint.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe fake pages prompt victims to submit device passcodes, Apple Account credentials, and two-factor authentication codes.T1566.002 · Spearphishing LinkThe operators send phishing messages directing victims to fake Find My or Apple pages to enter passcodes and credentials.T1656 · ImpersonationThe operation impersonates Apple in messages and uses a voice agent persona presented as “Alice from Apple Support.”
Products
Activation LockAnonyMousKIT is a phishing-as-a-service platform that automates stealing Apple device unlock codes, bypassing Activation Lock, and harvesting Apple IDs, iCloud backups, and Keychain credentials.Apple AccountApple’s Activation Lock feature activates automatically when the Find My tracking service is turned on, and links the iPhone device to the owner’s Apple Account.Find MyApple’s Activation Lock feature activates automatically when the Find My tracking service is turned on, and links the iPhone device to the owner’s Apple Account.iCloudAnonyMousKIT is a phishing-as-a-service platform that automates stealing Apple device unlock codes, bypassing Activation Lock, and harvesting Apple IDs, iCloud backups, and Keychain credentials.iPhoneApple’s Activation Lock feature activates automatically when the Find My tracking service is turned on, and links the iPhone device to the owner’s Apple Account.KeychainAnonyMousKIT is a phishing-as-a-service platform that automates stealing Apple device unlock codes, bypassing Activation Lock, and harvesting Apple IDs, iCloud backups, and Keychain credentials.
Countries
BrazilSOCRadar linked the operation to 506 domains and 168 reseller storefronts, with campaigns focused heavily on Brazil and reaching victims in multiple countries.IndiaSOCRadar reports that the campaigns facilitated by the AnonuMousKIT had a global footprint, but were more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil.IndonesiaSOCRadar reports that the campaigns facilitated by the AnonuMousKIT had a global footprint, but were more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil.ItalySOCRadar reports that the campaigns facilitated by the AnonuMousKIT had a global footprint, but were more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil.KenyaSOCRadar reports that the campaigns facilitated by the AnonuMousKIT had a global footprint, but were more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil.South AfricaSOCRadar reports that the campaigns facilitated by the AnonuMousKIT had a global footprint, but were more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil.
Industries
corporateA compromised Apple ID could expose iCloud backups, Keychain passwords, work email, and other corporate information stored on personal or employer-issued Apple devices, SOCRadar warns.GovernmentThe researchers found that a small percentage of the emails from the platform were sent to government and corporate organizations.