Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
SOCRadar details AnonyMousKIT, a phishing-as-a-service platform using AI voice agents posing as Apple Support to steal passcodes and 2FA codes.
SOCRadar's Threat Research Unit documented AnonyMousKIT, a credit-metered phishing-as-a-service platform that strips Activation Lock from stolen Apple devices across email, SMS, WhatsApp, recorded calls and AI voice agents. The 'Alice from Apple Support' personas request the device passcode, Apple ID credentials and a live 2FA code, with lures citing the handset's model identifier and live Find My status. Of 200 recovered AI calls made between August 31, 2025 and May 30, 2026, 179 targeted Brazil, and the calls cost $19.24 total via voice platform Vapi. Exposed log paths revealed 30 kit installations on 42 domains and 6,092 send attempts family-wide between March and July 2026.
- Lures spoof Apple, Find My and Apple Support; 627 of 691 logged sends relayed through one Gmail account.
- 92.7% of 6,092 targeted devices run A12 or newer silicon, making checkm8-based technical bypasses obsolete.
- Exposed relative file paths leak kit logs; three storefronts launched the same second, assessed as one buyer.
- South Africa received 1,735 family-wide sends, including 27 to government addresses whose devices were stolen.
- ATT&CK
- T1566.004 Spearphishing VoiceT1621 Multi-Factor Authentication Request GenerationT1656 Impersonation
- Products
- Activation LockFind My
- Threat actors
- AnonyMousKIT
- Countries
- BrazilSouth Africa
From the original article
5 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.