Threat intelligence company SOCRadar has uncovered a phishing-as-a-service platform known as AnonyMousKIT. It uses fake messages and pages, alongside AI-powered voice agents, to trick owners of stolen iPhones into surrendering their passcodes and Apple Account data. According to the report published on August 25, 2026, the platform has been active since early 2024 and supports an ecosystem for selling stolen devices and collecting Apple ID data and access to iCloud backups and Keychain data.
SOCRadar was able to analyze the service’s infrastructure after its researchers exploited the operators’ use of exposed relative paths. The analysis showed that AnonyMousKIT is linked to 506 domains and 168 brands operating as storefronts or resellers for the service, indicating that the activity is not a single phishing campaign but an organized service that can be used by multiple operators.
How does the platform target owners of stolen devices?
The process begins by using the contact information that the device owner enters when placing the device in Lost Mode, followed by contacting them via email, text messages, WhatsApp, or phone calls. The messages impersonate Apple and mention the correct device model and IMEI number, lending some credibility to the claim that the phone has been found.
The victim is then taken to a fake page that imitates Find My or one of Apple’s pages and is asked to enter the device passcode, Apple Account details, and two-factor authentication code. In some cases reviewed by SOCRadar, a voice agent introduced itself as “Alice from Apple Support” and told the victim that someone had tried to unlock the phone and brought it to an Apple Store. It then asked the victim to confirm ownership by dictating the passcode and subsequently directed them to the phishing page.
Figures reveal the scale of the infrastructure
Researchers recovered records of 200 calls made with victims between August 2025 and May 2026. The calls relied on 55 different interactive scripts carried out by a voice agent through five personas. SOCRadar says that each call costs the operator approximately $0.10 and that 90% of the analyzed calls targeted numbers in Brazil.
Although the campaigns have a global scope, researchers observed additional concentrations in South Africa, Indonesia, Italy, India, Kenya, and Brazil. A small percentage of the platform’s messages also reached government entities, institutions, and companies, expanding the campaign’s potential impact beyond the stolen-device market.
Why does this matter?
The platform’s significance lies in the way it links device theft with the theft of its owner’s digital identity. Providing the passcode and account data may enable attackers to access personal data, iCloud backups, passwords stored in Keychain, work email, and other organizational information present on personal devices or devices issued by employers.
After obtaining the codes, attackers can, according to SOCRadar, access the victim’s data, reset the device, remove it from the Find My app, and then sell it rather than limiting its sale to spare parts. The report’s key qualification, however, is that the operation’s success depends on persuading the device owner to disclose sensitive codes. Therefore, the presence of an automated call does not constitute evidence that Apple’s systems themselves were compromised; instead, it shows how accurate device information, social engineering, and synthetic voice are used to overcome the victim’s caution.