In response to SOCRadar Threat Research Unit (STRU) research, security researchers have identified AnonyMousKIT as a credit-based service designed to assist criminals in defeating Apple's Activation Lock. By using this platform, attackers can communicate with their victims via email, SMS, WhatsApp, recorded calls, and artificial intelligence-generated voice agents posing as Apple Support representatives. 

AnonyMousKIT also makes the contact appear legitimate by utilizing information tied to the stolen device. By providing a serial number or IMEI to the platform, attackers can identify the device's model and determine whether it is currently in Find My. Victims can be directed to Apple-branded pages with an animated map showing the location of the device reported. 

People whose devices have recently been lost or stolen are more likely to actively check for their whereabouts as a result of these campaigns. By providing accurate device information and describing the circumstances surrounding the theft, attackers can increase the likelihood that the communication is a genuine notification regarding recovery or support. 

In most cases, the campaign seeks a device's passcode, followed by Apple ID credentials and an Apple 2FA code. Apple's support guidance states that legitimate representatives do not request passwords, device passcodes, or 2FA codes. With anonymousMousKIT, customers are permitted to choose from a variety of methods for contacting victims through a credit-based model. 

Email campaigns cost 1.50 credits, recorded voice calls cost 1 credit, and artificial intelligence voice agents cost 2 credits. A single set of stolen-device details can also be used for SMS and WhatsApp, allowing attackers to take multiple approaches to the same victim from a single set. Researchers identified the operation as more than just a conventional phishing kit, describing it as similar to a subscription-based criminal service, with credit packages, pricing tiers, customer support, and mechanisms for replacing compromised infrastructure. 

A stolen iPhone can have a number of consequences in addition to unlocking it. An attacker may be able to access the information stored in the account, including iCloud backups and other credentials, if he or she obtains the associated Apple ID credentials and 2FA code. Additionally, SOCRadar found coding errors within the platform that exposed links between multiple domains and backend installations, providing researchers with additional insights into the operation's infrastructure. 

With the AI voice component, SOCRadar was able to locate 200 call records and 55 transcripts related to the commercial voice platform Vapi which provide a closer look at the social engineering process. The callers appeared as “Alice” from Apple Support, and were able to use five voice personas across English, Spanish and Brazilian Portuguese.

Call recordings were collected between August 31, 2025, and May 30, 2026. 179 of 200 calls were directed to Brazilian telephone numbers. The fake support agent confirms ownership of the device before requesting the four- or six-digit passcode of the device in the reviewed conversations. After repeating the digits for confirmation, the agent claims to have been contacted by an Apple Store regarding an Activation Lock issue. 

The conversation then moves to the recovery link that was supposedly sent via text message. As determined by the recovered records, the voice operation was relatively inexpensive to run, with all 200 calls requiring approximately $19.24 per call. However, the available data does not indicate how many victims actually surrendered their passcodes, Apple ID credentials or 2FA codes. 

Among the recorded calls, 100 ended when the recipients hung up, 48 timed out due to silence, 24 did not receive an answer, and 28 ended because of platform errors or busy signals. The researchers also discovered that the call records had been retrieved due to an accessibility flaw in the platform's codebase. 

Two file paths exposed through the shared code enabled unauthenticated access to files stored in the web root, enabling the recovery of call logs and transcripts. Since the vulnerability was inherited by deployments based on the same codebase, it provides valuable insight into the broader infrastructure supporting AnonyMousKIT.

AnonyMousKIT demonstrates a structured criminal supply chain rather than a standalone phishing campaign, according to SOCRadar. Developers of the platform build and sell it, customers license the platform through storefronts, and operators use those services to conduct phishing campaigns. In addition to outsourcing the credential-harvesting process, criminals can concentrate on resale of stolen devices while criminals with limited technical expertise can perform the credential-harvesting process.

Activation Lock represents an important threat to criminals who steal devices. Once Find My is activated, an iPhone remains associated with its owner's Apple ID even after a factory reset, which creates a broader threat. 

By obtaining the account credentials and verification codes, attackers are able to defeat a security mechanism that otherwise makes activating and reselling stolen devices difficult. At the conclusion of SOCRadar's investigation, AnonyMousKIT was still active, emphasizing the increasing use of automated services to target stolen devices. According to the operation, criminals have been able to steal credentials from lost or stolen iPhones by combining stolen data, phishing and artificial intelligence. 

Apple accounts that have been compromised can expose data far beyond the device itself, posing a significant security risk to those who receive them.