Researchers uncovered a phishing-as-a-service platform (“AnonyMousKIT”) used by phone thieves to trick victims into handing over iPhone passcodes, Apple ID passwords, and live 2FA codes so thieves can remove Apple’s Activation Lock. The operation uses Apple-branded emails/pages and AI voice agents that call victims while impersonating Apple Support and walking them through a scripted “recovery” process.
This campaign centers on a phishing-as-a-service kit called AnonyMousKIT, built to help phone thieves remove Apple's Activation Lock from stolen devices. Instead of attacking Apple's systems directly, the kit targets the device owner, using email, SMS, WhatsApp, recorded voice calls, and AI voice agents to walk victims through a scripted recovery flow. Emails used subjects like "Your device has been found" and "Alert," with spoofed Apple-related display names and links to Apple-branded capture pages that even rendered an animated map of the phone's reported location.
On the voice side, an AI agent persona named Alice from Apple Support called victims directly. In recovered transcripts, the agent asked the victim to confirm ownership, requested the device passcode, and read the digits back to confirm accuracy. It then claimed someone had visited an Apple Store to remove the Activation Lock and asked whether a recovery link had arrived by text, a step designed to capture a live 2FA code in real time.
The pretext exploits a moment of genuine stress: a lost or stolen device. Victims already believe something is wrong, so a message claiming their device was "found" or an unsolicited support call about Activation Lock feels plausible rather than suspicious. The use of Apple branding, device-specific details like model identifiers and Find My status, and a calm, human-sounding AI voice agent all reinforce a sense of legitimacy that generic phishing lacks.
Apple's own guidance is unambiguous: the company will never ask for a password, device passcode, or 2FA code as part of support. Treat any such request, regardless of how official it sounds, as a red flag. "Device found" messages should be verified through official Apple channels rather than by clicking the provided link. Suspicious Apple-branded emails or texts can be reported directly to Apple rather than answered. For high-value accounts, moving to physical hardware security keys removes the real-time 2FA interception these attacks depend on, since a code read over the phone can no longer be reused to complete authentication.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
AnonyMousKIT is a phishing-as-a-service platform used by phone thieves to remove Apple's Activation Lock by tricking device owners into revealing their passcode, Apple ID credentials, and a live 2FA code.
An AI voice agent persona named Alice from Apple Support calls victims, asks them to confirm ownership, requests the four or six digit passcode, reads it back for confirmation, then asks about a recovery link sent by text.
No. Apple's own guidance states it will never ask for a password, device passcode, or 2FA code to provide support, and any message or call requesting these should be treated as suspicious.
Do not share any codes or credentials, and report Apple-branded phishing emails or texts to Apple's official reporting address rather than engaging with the sender or caller.
Lost your iPhone and then get an email: “Your device has been found”? That’s the setup for a new AI-powered Apple Support scam. You click the link and land on an Apple-branded /help?TOKEN page. Then an AI voice calls: “Hello, this is Alice from Apple Support,” and walks you through entering your 4- or 6-digit passcode, Apple ID, and a live 2FA code to ‘recover’ your phone. Here’s the tell: Apple’s own guidance says it will never ask for your password, device passcode, or 2FA code. Real support will not read your passcode back to you or ask if a ‘recovery link’ just arrived by text. If you get a “device found” message or a call from “Alice at Apple Support,” hang up, don’t click the link, and report it to reportphishing@apple.com and our security team.
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
The roundup describes real social-engineering incidents: a phishing email that led an employee to enter credentials on a fake Microsoft 365 login page, and a wave of voice-phishing attempts against major hedge funds using voice-mimicking technology. Both incidents show practical lures that can be…
A real “fake recruiter” phishing campaign (tracked as RecruitTrap) is targeting employees’ corporate credentials, especially on mobile devices. The scam uses lookalike recruitment domains and full-screen fake login pages that hide browser cues, and it rejects personal email addresses to focus on…
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Scammers are running Microsoft-branded “SysScan” websites that display a fake security scan and falsely claim Windows no longer supports third‑party antivirus. Victims are pressured to uninstall their antivirus, submit personal and banking details, and prepare for a “refund manager” phone call,…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
