AnonyMousKIT Turns Lost iPhones Into Unlock Targets
SOCRadar says AnonyMousKIT is a credit-metered phishing-as-a-service platform that uses AI voice agents and other lures to target owners of recently lost or stolen Apple devices. In the recovered data, the operators had 200 call records and pushed victims toward Apple-branded pages and calls that asked for device passcodes, Apple ID details, and live two-factor codes.
The trick is to sound like Apple Support at the exact moment someone is trying to recover a missing phone. Once the attacker gets the passcode and one-time code, they can remove Activation Lock, which is what normally keeps a stolen iPhone tied to its owner and hard to resell.
For Apple fleets and help desks, the exposure sits in the recovery conversation, not on the handset itself: a successful social-engineering call can turn a stolen device into a usable one and expose the owner’s Apple ID to follow-on use. The reporting does not show a software flaw, only a scalable theft-recovery scam that makes the human handoff the weak point.