AnonyMousKIT PhaaS Automates Apple ID, Device Passcode, and Live 2FA Harvesting Across Five Channels

AnonyMousKIT, an AI-enabled Phishing-as-a-Service (PhaaS) platform built to turn stolen Apple devices into monetizable assets.

The service automates the collection of an owner’s device passcode, Apple ID credentials and live two-factor authentication (2FA) codes information that can enable criminals to remove Activation Lock and resell a stolen device.

Rather than relying on a single phishing message, AnonyMousKIT builds a persistent victim-engagement workflow around details extracted from stolen handsets.

Operators enter a device profile once, then launch coordinated campaigns through email, SMS, WhatsApp, pre-recorded voice calls and AI-powered vishing.

The five-channel model allows threat actors to keep pressuring a victim until they engage with a lure.

Apple’s Activation Lock, introduced with iOS 7, binds a device to its owner’s Apple ID and sharply reduces the value of stolen hardware.

That protection has in turn created a criminal service market focused on harvesting the credentials needed to defeat it.

AnonyMousKIT appears designed specifically for this post-theft phase: it uses real device model identifiers, Find My status and owner contact data to make fraudulent recovery notifications appear credible.

STRU’s “inside-out” analysis was enabled by a basic operational-security mistake in the shared codebase.

Bare relative file paths reportedly exposed production logs, operator data and backend artifacts through unauthenticated web access.

The exposure gave researchers visibility into the platform’s email activity, WhatsApp operations, source code, AI agent prompts, and voice call records.

The findings point to an ecosystem rather than a standalone phishing kit. SOCRadar linked the family to 506 domains and 168 storefront brands, with 30 distinct backend deployments identified across 42 domains.

The infrastructure has been active since at least early 2024, while evidence indicates the operation remained active through August 2026.

The victim is then directed to a spoofed Apple or Find My-themed page that presents location visuals and anti-bot checks before sequentially requesting the device passcode, Apple ID and a current 2FA code.

Captured data is sent to the operator panel and Telegram webhooks, enabling near-real-time use.

This sequence matters because an Apple ID password alone may not be sufficient to take over the account or remove protections; the platform is engineered to solicit the additional passcode and time-sensitive verification code needed to complete the fraud.

SOCRadar Threat Research Unit (STRU) has conducted AnonyMousKIT’s phishing flow begins with device profiling. Operators obtain the model and Find My state of a stolen Apple device, create a victim record, and generate a tokenized lure.

AnonyMousKIT PhaaS Platform

Email remains the best-documented channel. STRU recovered 691 email-send attempts from the core AnonyMousKIT deployment, with 649 delivered, while the wider 30-backend family logged 6,092 emails.

Four distinct binaries are hosted on the panel’s Extensions “How to use?” page. Two of these applications are proprietary tools developed by the operator.

A large share of delivered messages reportedly passed through a single free Gmail relay disguised as an Apple no-reply account.

Subjects such as “Your device has been found” and location-themed content exploit the urgency of a recent loss or theft.

The AI-vishing component illustrates how commercial voice tooling is being incorporated into commodity cybercrime services.

AnonyMousKIT subscribers could choose preconfigured agents impersonating “Alice” from Apple Support in English, Spanish and Brazilian Portuguese.

Recovered artifacts showed 200 AI call records between August 2025 and May 2026, including 55 transcripts. About 90% of calls targeted Brazil, and the total AI service cost was just $19.24 roughly 9.6 cents per attempt.

At that price, operators have little incentive to be selective, enabling repeated attempts against owners of stolen devices.

The scripts are structured to establish trust, claim that a lost phone has been recovered, request a four- or six-digit passcode, and then guide the target to a phishing link delivered by SMS or another channel.

The approach demonstrates how AI agents can operationalize scripted social engineering at scale without requiring a human caller for every attempt.

While the immediate objective is Activation Lock removal, a successful attack can have broader consequences. Apple IDs may provide access to iCloud backups, stored credentials in iCloud Keychain and work-related data synchronized to personal devices.

STRU observed institutional targets among the campaign data, including government, education and corporate domains.

For defenders, the campaign reinforces a simple but important rule: Apple does not legitimately call users to request a device passcode, Apple ID password or live 2FA code.

Organizations should brief employees especially those who lose company-managed or personally owned devices used for work to treat any recovery-themed call, SMS, WhatsApp message or email as potentially hostile.

Users should keep Lost Mode contact details minimal, avoid following links in unsolicited “device found” messages, and enter account credentials only through Apple’s official apps or manually typed Apple domains.

The AnonyMousKIT case shows that modern device theft is no longer only physical crime; it is a coordinated identity-harvesting operation designed to convert a stolen handset into account access, sensitive data and resale revenue.

Indicators of Compromise

Type	Indicator	Context
Infrastructure	anomkit[.]shop	AnonyMousKIT primary – SMTP relay, exposed logs
Infrastructure	apple-login-imaps[.]com	Initial investigation entry point – hosts ToolsController.php
Infrastructure	apple-thailand[.]co	Multi-role: infrastructure, panel, and lure hosting
Infrastructure	findsupport[.]live	AnonyMousKIT infrastructure
Infrastructure	irealm-server[.]com	i-Realm infrastructure
Cross-Brand Backend	uktservice[.]sa[.]com	UKT – oldest backend, SMTP non-functional
Cross-Brand Backend	apple-unlock[.]com	KG-KING / i-Realm – Cluster B

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide