AI-Powered AnonyMousKIT PhaaS Steals Apple IDs and 2FA Codes to Unlock Stolen iPhones
Brief
Researchers have uncovered AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) platform designed to help criminals unlock and resell stolen Apple devices.
The service targets iPhone owners with convincing Apple-themed emails, SMS messages, WhatsApp chats, recorded calls, and AI voice calls.
The platform abuses a common problem in phone theft. Apple’s Activation Lock makes a stolen iPhone difficult to reuse unless the thief obtains the owner’s Apple ID credentials.
Instead of technically bypassing the protection, AnonyMousKIT uses social engineering to trick victims into giving away their device passcode, Apple ID password, and six-digit two-factor authentication (2FA) code.
AnonyMousKIT runs as a credit-based criminal service. Subscribers enter information about a stolen device, including its model, owner details, and Find My status.