AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

What The Service Is Selling

BleepingComputer says SOCRadar tracked AnonyMousKIT as a phishing-as-a-service operation active since early 2024. The service is designed to help criminals unlock stolen iPhones, disable Activation Lock, and increase resale value while also exposing the victim's Apple account and synced data.

The reporting says the broader ecosystem is tied to harvesting Apple IDs, accessing iCloud backups, and reaching Keychain credentials, which turns a phone-theft story into a real identity and data-exposure story.

How The Lure Works

Victims receive emails that impersonate Apple and claim the missing phone has been located. The messages reportedly include the correct model and IMEI details to make the lure feel legitimate and urgent.

From there, the victim is sent to a fake Find My or Apple page and asked for the device passcode, Apple account credentials, and the two-factor authentication code. In some cases, an AI voice persona such as "Alice from Apple Support" reinforces the lie by claiming someone tried to unlock the phone at an Apple Store and asking the victim to confirm ownership verbally.

Why The Enterprise Angle Matters

This is not only a consumer-fraud problem. SOCRadar warns that a compromised Apple ID can expose iCloud backups, Keychain passwords, work email, and other corporate information on personal or employer-issued Apple devices.

The reporting also says researchers recovered records of 200 calls made between August 2025 and May 2026, using 55 interaction transcripts handled by a voice AI agent across five personas. That suggests a structured operation, not a one-off scam.

What Teams Should Do Next

• Tell employees and support staff that Apple or IT should never ask them to dictate a device passcode over the phone.
• Treat a stolen corporate or dual-use iPhone as an identity-and-data exposure event, not only a lost-device event.
• Review whether Apple account recovery, passcode-reset, and managed-device guidance are covered clearly in incident-response playbooks.
• Use this story to revisit how much corporate access or sensitive data can ride on a personal Apple ID tied to a work-used device.

Source Context

CyberExperts used BleepingComputer as the primary source and kept the operational details that matter most: early-2024 service activity, realistic Apple lures with model and IMEI details, fake Find My pages, AI voice personas, 200 recovered call records, and the iCloud/Keychain/work-email exposure angle described by SOCRadar.

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Cisco Talos adds something the broader Patch Tuesday roundups often miss: a defender's view of which Microsoft flaws are likely…

The 5-Minute Cyber Brief: August 28, 2026

The August 28 Cyber Brief tracks urgent Citrix and SharePoint exploitation, a critical zero-click WordPress risk, resilient GoCaracal malware, and…

HPE patches critical ArubaOS-CX remote code execution flaw

ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation…