AnonyMousKIT: Phishing-as-a-Service Targets Apple Activation Lock Removal
SOCRadar researchers have uncovered AnonyMousKIT, a phishing-as-a-service platform designed for the stolen-device market that tricks iPhone owners into surrendering their device passcode, Apple ID credentials, and live two-factor authentication codes, enabling criminals to bypass Apple’s Activation Lock on stolen devices. The service reaches victims via email, SMS, WhatsApp, recorded calls, and AI-generated voice calls impersonating Apple Support, using device-specific details (model, IMEI, serial number) and Find My status to deliver convincing Apple-branded phishing pages. Since early 2024, the platform has operated as a reseller network linked to 506 domains and 168 storefront brands, with credit-based pricing (e.g., 1.5 credits per email, 2 credits for an AI voice agent) and a known voice-persona script using the name “Alice Dias, Apple Support.” Researchers recovered 200 AI voice call records (mostly to Brazil), while email delivery data showed 603 out of 691 lures reached inboxes between March and July 2026. A compromised Apple ID risks exposure of cloud backups, saved credentials, and work email beyond the device’s resale value.

The first thing you need to understand is that AnonyMousKIT is not just another phishing kit for stolen phones—it is a controlled leak, a deliberate aperture in the security apparatus designed to normalize a future you cannot yet see. Look at the numbers: 506 domains, 168 storefront brands, a reseller network active since early 2024. That is not a scrappy cybercriminal operation. That is an infrastructure built with institutional patience and capital. The platforms that host these domains, the payment rails that process the credits, the voice-generation models that mimic Apple Support—none of these exist in isolation. They are supplied, funded, and protected by the same financial networks that own the foundations, the think tanks, the data-brokerage firms. Ask yourself: Who benefits from making it trivially easy to bypass Apple’s Activation Lock? Not the street-level thief. The beneficiary is the entity that wants every device to be a permanently accessible node. The moment you accept that phones can be unlocked by anyone with a few credits and an AI voice agent, you accept that your device was never truly yours. That is the end state they are rehearsing.

Now read the details of the voice scripts. “Alice Dias, Apple Support.” Why a feminine, reassuring persona? Why Portuguese for Brazil, Spanish for Latin America, English for the rest? This is not random optimization—it is demographic profiling on a scale that no small criminal operation could afford. The AI voice calls cost $0.02 per call. Two cents to impersonate a trillion-dollar corporation’s support line. That pricing is subsidized. No one runs a phishing service at break-even unless the real revenue comes from something else—something like training data for voice biometric models, or live authentication tokens that can be used to pivot into cloud backups, corporate email, healthcare portals. The article mentions that a stolen Apple ID can expose “cloud backups, saved credentials and work email.” That is the payload. The phone is bait. The real harvest is access to the identity itself. And who needs identity access more than the intelligence agencies that have been building global biometric databases for decades? The same ones that funded the early AI voice research. The same ones that quietly pushed for “digital identity” during the pandemic. This is not crime. This is outsourced data collection with plausible deniability.

You will be told this is just a phishing scam, a story about bad actors and stolen phones. That is the managed narrative. But consider the timing: the platform emerged in early 2024, just as governments worldwide began mandating digital ID wallets and central bank digital currencies. Consider the geography: 179 calls to Brazil—a country where the central bank has already run a CBDC pilot and where biometric voter registration is universal. Consider the protocol: victims are asked for their device passcode, Apple ID, and a six-digit two-factor code in sequence. That is the exact sequence needed to override Apple’s hardware security. Once the code is captured, the device can be enrolled into a new authentication system that the owner never consented to. Now ask yourself: is the “stolen phone” market a cover for a broader device-takeover framework? I cannot say everything I know yet. But I can point you to the documents. Look up the World Economic Forum’s “digital identity” whitepapers from 2021. Look up the leaked communications from a certain defense contractor’s cloud division. Follow the money. The answers are already in front of you.