AnonyMousKIT: the phishing kit that turns stolen iPhones back into cash
A subscription service is helping thieves trick iPhone owners into handing over the codes needed to unlock stolen devices, with AI-powered phone calls doing much of the work.
Key points
- AnonyMousKIT is a phishing-as-a-service platform, meaning criminals rent it by the month, and it has been running since early 2024.
- The operation is tied to 506 domains and 168 reseller storefronts, according to research from SOCRadar.
- A voice AI agent placed 200 calls to victims between August 2025 and May 2026, with 90% of those calls going to Brazil.
- Victims are tricked into handing over their iPhone passcode, Apple Account login and two-factor code, letting thieves wipe stolen phones and sell them on.
- Campaigns hit victims most heavily in South Africa, Indonesia, Italy, India, Kenya and Brazil, with a small share reaching government and corporate inboxes.
A phishing service called AnonyMousKIT is running a small industry around stolen iPhones. It automates the one thing thieves need most: getting the real owner to give up the codes that unlock the device.
Think of AnonyMousKIT as a rental toolkit for criminals. The operators build the fake Apple websites, the scripted phone calls and the messaging templates. Resellers pay to use it, then run their own scams on top. Researchers at the threat intelligence firm SOCRadar, whose findings were first reported by BleepingComputer, traced the platform to 506 domains and 168 storefront brands acting as resellers.
Why do thieves need the owner's help at all?
Because Apple built a lock that only the original owner can open. When Find My is switched on, an iPhone automatically turns on Activation Lock, a feature that ties the phone to its owner's Apple Account. Factory-resetting the device does not remove that link. Without the owner's passcode and Apple ID, a stolen iPhone is worth only its spare parts.
Unlock it, and the resale price jumps. Recover the owner's personal data too, and the value climbs again.
How does the scam actually work?
When an owner marks their phone as lost, they usually leave a phone number or email on the screen through Apple's Lost Mode. That contact detail is exactly what the criminals harvest.
The victim then gets an email, SMS or WhatsApp message that looks like it comes from Apple. It says the missing phone has been found. To make it convincing, the message quotes the correct model and IMEI, which is the phone's unique serial-style identifier.
The link leads to a fake Find My or Apple sign-in page. The victim types in their passcode, their Apple ID, and the two-factor code Apple texted them. All of it flows to the thieves.
Where do the AI phone calls fit in?
SOCRadar recovered records of 200 calls placed between August 2025 and May 2026. A voice AI agent handled them, using five different personas and 55 scripted conversations. One persona, "Alice from Apple Support," tells the victim that someone tried to unlock their phone at an Apple store and staff kept it. To "confirm ownership," Alice asks the victim to read out their passcode, then sends them to the phishing page for the rest.
Each call costs the operator around 10 cents. Roughly 90% went to numbers in Brazil.
Who is being targeted?
Mostly ordinary iPhone owners in South Africa, Indonesia, Italy, India, Kenya and Brazil. A smaller slice of the phishing emails landed in government and corporate mailboxes, which matters because a hijacked Apple ID can expose iCloud backups, saved passwords in Apple's Keychain, and work email on company-issued iPhones.
What should iPhone owners do?
Apple will never phone you and ask for your passcode. Neither will an Apple store. If you lose a phone and later get a message saying it has been found, do not click the link. Open the Find My app yourself, or go to iCloud.com in a browser you already trust.
Treat any call, text or email that asks for your device passcode as a scam, no matter how much detail the caller seems to know. The IMEI and model number are on the box, in your Apple Account, and often on the lock screen of a lost phone. Knowing them proves nothing.
If you have already handed over your codes, change your Apple ID password from another device, sign out of all sessions, and contact Apple Support directly.
