IT House reported on August 27 that network security company SOCRadar published a blog post on August 25, disclosing a phishing-as-a-service (PhaaS) platform called AnonyMousKIT, which mainly serves the unlocking and resale chain of stolen Apple devices.
The platform uses emails, text messages, WhatsApp, recorded calls and AI voice calls to defraud device owners into lock screen passwords, Apple IDs and 2FA verification codes in order to remove activation locks and resell the devices.
The platform adopts a credit-based billing model. After subscribers enter the stolen device model, owner information, phone number, location link and Find My status, they can deliver bait through a total of 5 channels: email, SMS, WhatsApp, pre-recorded voice and AI voice.
Once the victim visits the phishing page, the platform will collect the 4-digit or 6-digit device password, Apple ID credentials and 6-digit two-factor authentication code in sequence, and transmit the data back to the operation panel and Telegram Webhook.
SOCRadar noted that AnonyMousKIT is associated with 506 domain names and operates a massive network of 168 store brands that act as resellers.
Email is the platform’s most well-documented channel. AnonyMousKIT recorded 691 delivery attempts from March to July 2026, of which 603 bait emails arrived in inboxes.
In addition, the AnonyMousKIT platform uses AI voice phishing, and the cost of 200 calls is US$19.24 (IT House Note: The current exchange rate is approximately 129.6 yuan), which is approximately 9.6 cents per attempt (the current exchange rate is approximately 0.65 yuan). The median call duration was 22 seconds and the maximum was 20 minutes.
These AI voice phishing tactics uniformly impersonate “Alice Dias” from Apple customer service, and induce the victim to dictate the device password and open the phishing link in the text message on the pretext of assisting in retrieving the lost device.
