AnonyMousKIT phishing-as-a-service uses AI voice calls to steal iPhone passcodes
SOCRadar details AnonyMousKIT, an active phishing-as-a-service platform using AI voice agents across 506 domains to steal Apple ID credentials from stolen iPhone owners.
SOCRadar analyzed AnonyMousKIT, a pay-per-action phishing-as-a-service platform built to harvest Apple ID credentials needed to remove Activation Lock from stolen iPhones. A bare-relative-paths flaw exposed a reseller supply chain of 506 domains and 168 storefront brands active since early 2024, plus 200 call logs and 55 transcripts, with 179 of 200 calls going to Brazil at a total cost of $19.24. Voice-agent personas like 'Alice Dias, Apple Support' convince victims to dictate their four- or six-digit passcode and enter an unlock code from a security link, allowing thieves to remove Activation Lock and resell devices. The platform ran five personas in English, Spanish, and Brazilian Portuguese and remained active at the end of the investigation.
- Targets recent victims of iPhone theft during active device searches.
- Operates as a tiered business: developer, branded storefront buyers, and operators.
- Extracts device model and live Find My status from serial number or IMEI.
- Basic coding errors exposed production logs and operator rosters despite AI use.
- Still active as of the last day of SOCRadar's investigation.
- Vendors
- AnonyMousKITSOCRadar
- Threat actors
- AnonyMousKIT
- Organizations
- Apple
- Countries
- Brazil
From the original article
2 min read at helpnetsecurity.com
A phishing-as-a-service (PhaaS) platform called AnonyMousKIT is automating the theft of Apple ID credentials needed to remove Activation Lock from stolen iPhones, SOCRadar found. “By leveraging a critical flaw – the use of bare relative paths – the investigation unraveled a reseller supply chain of 506 domains and 168 storefront brands active since early 2024.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.