A newly documented phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates one of the most effective scams in the iPhone theft ecosystem: tricking the phone’s rightful owner into giving up their passcode so criminals can unlock the stolen device and sell it.
Apple’s Activation Lock ties every iPhone to its owner’s Apple Account — even after a factory reset, the phone can’t be set up without authorization. Because of this, stolen iPhones are worth far more to thieves if they can be unlocked, and AnonyMousKIT exists entirely to solve that problem. Threat intelligence firm SOCRadar found the platform connected to 506 domains and 168 reseller storefronts. Between August 2025 and May 2026, researchers recovered records of 200 calls made to victims, handled by a voice AI agent running under five different personas — including one called “Alice from Apple Support.” Each call costs the operator roughly $0.10, making the operation cheap to run at scale. Ninety percent of calls targeted people in Brazil, with additional campaigns in South Africa, Indonesia, Italy, India, and Kenya.
The scam works by first pulling the victim’s contact information from the phone’s Lost Mode display, then sending a message — email, SMS, WhatsApp, or a phone call — claiming the missing device was found. The message includes the correct model and IMEI number to seem credible. The victim is directed to a fake Find My or Apple page and asked to enter their passcode, Apple ID credentials, and a two-factor authentication code. In the phone-call variant, the AI agent tells the victim their phone was brought to an Apple Store and asks them to “confirm ownership” by dictating the passcode. Once thieves have those credentials, they can access iCloud backups, Keychain-stored passwords, work email, and other sensitive data — then wipe and sell the device.
How to check if you’re affected
Affected devices are any iPhone that has been lost or stolen and is still linked to your Apple ID. If you receive a message claiming your missing iPhone was found — especially one that asks for a passcode, Apple ID password, or verification code — do not respond and do not click any links. Apple will never call you and ask for your passcode or 2FA code. Report the message to Apple at reportphishing@apple.com, then lock the device via iCloud.com > Find My and mark it as Lost Mode if you haven’t already.