Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform built to strip Apple's Activation Lock from stolen devices, using rented AI voice agents that call theft victims posing as Apple Support and ask for their device passcode.
SOCRadar Threat Research Unit (STRU) said the platform, which it tracks as AnonyMousKIT, is credit-metered and drives lures across five channels from a single victim record, comprising email at 1.50 credits, SMS priced per sender ID, WhatsApp, a recorded voice call at 1 credit, and an AI voice agent at 2 credits.
The targets are owners of Apple devices that were recently lost or stolen, and the pages and calls ask each of them for the 4- or 6-digit device passcode, then the Apple ID credentials, and finally a live two-factor authentication (2FA) code. Apple's own guidance states that the company never asks for a password, device passcode, or 2FA code to provide support.
"AnonyMousKIT is best understood not as a phishing kit but a small software business with a criminal customer base. It features credit bundles, published pricing, tiered subscriptions, customer support, status tracking, and infrastructure replacement protocols," SOCRadar said in a Monday report.
Activation Lock, introduced in iOS 7, ties the hardware to a specific Apple ID and renders a stolen handset unusable until the owner's account is removed.
Lures cite the handset's internal Apple model identifier and its live Find My status, both pulled from the stolen device itself. Victims who follow the link reach an Apple-branded capture page that renders an animated map of the handset's reported location.
The AI voice channel is the best-documented vector after email, with 200 call records, 55 transcripts, and five configured personas recovered from the operator's account with the commercial voice platform Vapi.
The researchers' report does not say whether the account was reported to Vapi, and neither company has said publicly whether it is still active. All five personas carry the same translated identity, Alice from Apple Support, across English, Spanish, and Portuguese.
The calls ran between August 31, 2025 and May 30, 2026, and 179 of the 200 went to numbers in Brazil. In the recovered transcript, the agent asks the victim to confirm ownership, then requests the four- or six-digit passcode and reads the digits back for confirmation.
It then explains that someone visited an Apple Store to remove the Activation Lock and asks whether a recovery link has arrived via text. The researchers put the total cost of the 200 calls at $19.24, or about 9.6 cents each.
The outcome table in the report assigns all 200 calls to one of four results, comprising 100 victims who hung up, 48 silence timeouts, 24 no-answers, and 28 platform errors or busy signals. No count of captured passcodes, Apple IDs, or 2FA codes appears in the report for any of the five channels.
The logs reached SOCRadar via two bare relative file paths in the shared codebase that resolve to the web root and allow unauthenticated HTTP access. Every deployment of that codebase inherits the flaw.
A scan of 506 kit-family domains identified 30 distinct installations reachable on 42 domains, with 188 of the 506 live.
The AnonyMousKIT installation logged 691 send attempts between March and July 2026, compared with 6,092 across the 30 backends.
Three storefronts, i-Blocker, Key Unlock, and KG-KING, launched in the same second on April 10, 2026, sharing the same Gmail relay accounts. SOCRadar assessed that pattern as one buyer running three brands rather than three separate customers.
The researchers recorded the following characteristics of the email lures -
- The top two subject lines were "Your device has been found" (308 of 691) and "Alert" (157)
- Display names spoofed Apple, Find My, Apple Support, and Apple Assistance
- 627 of the logged sends relayed through a single free Gmail account, noreplyapple00000[@]gmail[.]com, against 20 and 2 for the two other relay accounts
- 678 of the 691 lures carried a location token naming a city, including Johannesburg, Abuja, Buenos Aires, Maputo, and Mumbai
- Victim-facing capture pages were served from tokenized /help?TOKEN URLs
South Africa accounts for 1,735 of the 6,092 family-wide sends, and 64 of AnonyMousKIT's own 691 sends reached non-consumer domains, including 27 to South African government addresses. SOCRadar said those recipients were selected because their devices were stolen, not because of their roles.
The report said the four unlock tools offered on the panel serve as bait, because 5,649 of the 6,092 targeted devices, or 92.7%, run A12 silicon or newer.
The checkm8 bootrom exploit reaches only A5 through A11 chips. It also states that technical bypasses are obsolete now that Apple has moved past the checkm8 generation. A public bootrom exploit for A12 and A13 was released on June 18, 2026, two months before the report, and its proof of concept remains live.
Its authors describe it as a tethered bootrom exploit requiring physical possession and device firmware update (DFU) mode, and the research does not show a Secure Enclave compromise. Its control tool demotes the device to production mode or boots a raw iBoot image, and neither action recovers a device passcode or removes Activation Lock.
SOCRadar described the automated, LLM-driven voice vector as the platform's primary innovation.
In March, Mirage Security analyzed a subscription vishing service with commercial text-to-speech embedded as a core feature, and The Hacker News reported in May on an earlier AI vishing kit.
Infoblox Threat Intel documented the same unlock-kit ecosystem in May using DNS telemetry, publishing a list of 4,244 malicious domains detected between March 2022 and May 2026.
"By combining technical tooling and social engineering, thieves now have a way to unlock devices at scale and make phone theft profitable," Infoblox Threat Intel researchers Maël Le Touz and Elena Puga said.
Identical second-level labels across different top-level domains are a pattern match rather than an attribution to a single operator.
"Apple will never ask you to log in to any website, or to tap Accept in the two-factor authentication dialog, or to provide your password, device passcode, or two-factor authentication code or to enter it into any website," Apple said in support documentation published on June 15, 2026.
Apple directs users to forward Apple-branded phishing email and text messages to [email protected].
The researchers recommended moving high-value Apple IDs to physical hardware security keys, which it said completely mitigates the real-time 2FA interception that is the funnel's ultimate objective.
The Hacker News contacted Apple for comment on the research; the company had not responded by the time of publication.
The development comes as German and U.S. law enforcement dismantled Kratos in July, pulling more than 200 servers offline, and Indonesian authorities arrested the man they say developed and ran it.
"The platform was still running on the last day of our analysis. SOCRadar continues to track it, its sibling storefronts, and the wider shared-codebase family, and will report material changes," the company said.