A phishing-as-a-service platform is using rented AI voice agents that pose as Apple support to harvest credentials and strip Activation Lock from stolen iPhones, researchers at SOCRadar found.
The service, tracked as AnonyMousKIT, targets recent victims of device loss or theft. Subscribers enter a serial number or IMEI, and the platform pulls the model and live Find My status before contacting the owner by email, SMS, WhatsApp, recorded call, or voice agent.
The AI voice channel is the best-documented vector: 200 call records, 55 transcripts, and five personas recovered from the operator’s account with commercial voice platform Vapi. All five personas use the identity Alice from Apple Support in English, Spanish, and Portuguese. In the transcripts, the agent confirms ownership, asks for the four- or six-digit passcode, then spins a story about someone trying to unlock the phone at an Apple store and walks the victim through entering a recovery code.
The 200 calls cost just $19.24 total, and 179 went to Brazil. The whole approach leans on a gap between real Apple policy and victim expectations: Apple says it never asks for a passcode, password, or 2FA code during support.
SOCRadar describes the platform as a small software business with a criminal customer base, complete with credit bundles, pricing tiers, and support. It spans 506 domains and 168 storefront brands active since early 2024, and it was still operating when the investigation ended. The harvested credentials let thieves remove Activation Lock and prep the handset for resale.
