Full Report
Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode. SOCRadar Threat Research Unit (STRU) said the platform, which it tracks as AnonyMousKIT, is credit-metered and drives lures across
Analysis Summary
# Tool/Technique: AnonyMousKIT (Phishing-as-a-Service)
## Overview
AnonyMousKIT is a sophisticated Phishing-as-a-Service (PhaaS) platform designed specifically to bypass Apple's Activation Lock on lost or stolen devices. The platform functions as a "small software business" for cybercriminals, providing automated tools to social engineer victims into revealing device passcodes, Apple ID credentials, and two-factor authentication (2FA) codes. It distinguishes itself by integrating commercial AI voice agents to simulate professional tech support calls.
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Social Engineering Framework
- **Platform:** Apple iOS (Target); Web-based (Attacker Infrastructure)
- **Capabilities:** AI voice synthesis, SMS/WhatsApp/Email lures, real-time location spoofing, automated credential harvesting, and 2FA interception.
- **First Seen:** Active operations recorded between August 31, 2025, and May 30, 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Service]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1111 - Two-Factor Authentication Adversary-in-the-Middle]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery] (Model and Find My status)
## Functionality
### Core Capabilities
- **Multi-Channel Lures:** Orchestrates attacks across five channels: Email, SMS, WhatsApp, recorded voice calls, and AI-driven voice agents.
- **Credit-Metered Business Model:** Operates via tiered subscriptions and credit bundles (e.g., AI voice calls cost 2 credits, while emails cost 1.5 credits).
- **Data Harvesting:** Specialized capture pages that mirror Apple’s branding, requesting 4/6-digit passcodes, Apple ID passwords, and live 2FA codes.
- **Location Rendering:** Displays animated maps showing the stolen device’s supposed location to increase the lure's legitimacy.
### Advanced Features
- **AI Voice Personalization:** Utilizes the commercial platform **Vapi** to deploy AI personas (e.g., "Alice from Apple Support") capable of natural language interaction in English, Spanish, and Portuguese.
- **Information Synchronization:** Pulls specific hardware data (Apple model identifiers) and "Find My" status directly from the stolen device to populate phishing templates.
- **Infrastructure Management:** Includes protocols for infrastructure replacement and status tracking of victim interactions.
## Indicators of Compromise
- **File Names:** Codebase reveals relative file paths for logs accessible via web root (vulnerability exploited by researchers).
- **Network Indicators:**
- `noreplyapple00000[@]gmail[.]com` (Primary relay account)
- `i-Blocker` (Storefront brand)
- `Key Unlock` (Storefront brand)
- `KG-KING` (Storefront brand)
- `Vapi[.]ai` (Used for AI voice agents)
- **Behavioral Indicators:**
- Phone calls from "Apple Support" requesting device passcodes or 2FA codes.
- Phishing URLs following the pattern: `[domain]/help?TOKEN=[Unique_Identifier]`
- Emails with subject lines: "Your device has been found" or "Alert."
## Associated Threat Actors
- **AnonyMousKIT Operators:** A organized group or individual running the PhaaS backend.
- **Unidentified Buyers:** Various criminal customers who lease the kit to unlock stolen hardware for resale.
## Detection Methods
- **Behavioral Detection:** Identify automated scripts interacting with Gmail/SMTP relays at high volumes. Monitor for unauthorized use of commercial AI voice API keys (like Vapi) for outbound social engineering.
- **URL Filtering:** Block domains using the specific `?TOKEN=` URL structure associated with the kit's capture pages.
- **Network Monitoring:** Flag communications between suspected phishing backends and known AI voice synthesis platforms.
## Mitigation Strategies
- **User Education:** Reiterate that Apple Support never asks for device passcodes, Apple ID passwords, or 2FA codes over the phone or via text.
- **Security Hardening:** Enable "Stolen Device Protection" on iOS, which adds layers of security when the device is away from familiar locations.
- **Incident Response:** If a device is stolen, victims should be wary of any "found" notifications that arrive via non-official channels or require credential entry on third-party sites.
## Related Tools/Techniques
- **Vapi:** A legitimate commercial AI voice platform co-opted for malicious use.
- **Fidsnitch/iCloud Bypass Kits:** Older generations of tools designed for Activation Lock removal.
- **Adversary-in-the-Middle (AiTM):** The technique used to intercept live 2FA codes.