AI-Powered PhaaS Supply Chain
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
Indicators of Compromise
- domain: apple-unlock.com
- domain: buscar-lphone.com
- domain: suporte-lcloud.com
- domain: com-maps.info
- domain: findmy-dispositivos.com
- domain: id-ubicacion.com
- domain: findsupport.live
- domain: zu7pl.pro
- hash: 07d4a6ac925f9f7e63c7332df1995de03f514931e9d97cb3dd7a72fecf569e11
- hash: 2c790296b404b3e7592da37b15311507b0e55989e1628eef1bb970acb13ec37f
- hash: 32fa60c9099f53f194a6a63c9341dd115434584e0890120ba1eca83ae33832bf
- hash: 5ea22f9777a34f461840c2a3988c717c0f9e6ec4bd95420c8643251e28ccc36b
- hash: d9e2881d3aa1ea40928dac65405fbe7e36989cad51ab46daf493afff757a2493
- ip: 196.196.102.74
- domain: alxescript.info
- domain: anomkit.shop
- domain: apple-login-imaps.com
- domain: apple-thailand.co
- domain: center-one.online
- domain: gon-unlocker.pro
- domain: irealm-server.com
- domain: key-unlock.com
- domain: kit-pro-bot.click
- domain: projectpartapple.com
- domain: spider-off-unlock.one
- domain: b.pro-center.my.id
- domain: apple-care-in.com
- domain: apple-localise.info
- domain: applelnfo.com
- domain: encontrar-dispositivos.cloud
- domain: find-alerts.com
- domain: findmylocalizado.com
- domain: fmi-dispositivo.com
- domain: fmi-dispositivos.com
- domain: i-cloudsd.com
- domain: icloud-inc-in.info
- domain: inc-locations.support
- domain: irealm-server.co
- domain: kanoondekho.com
- domain: prookit.com
- domain: rastreo-devices.com
- domain: trace-apple-in.com
AI-Powered PhaaS Supply Chain
Description
AnonyMousKIT is an AI-powered Phishing-as-a-Service platform engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered system, it automates credential harvesting through email, SMS, WhatsApp, and AI-driven voice phishing calls. The investigation exposed a reseller supply chain spanning 506 domains and 168 storefront brands active since early 2024. The platform targets owners of stolen Apple devices using device-specific lures with internal model identifiers and real-time Find My statuses. Conversational AI agents impersonating Apple Support conduct vishing operations, with over 200 calls placed primarily to Brazil at minimal cost. Coding vulnerabilities exposed 120,242 lines of operational logs, revealing 689 distinct WhatsApp operator accounts and detailed attack infrastructure. The ecosystem operates through a decentralized enterprise structure with developers, resellers, and hundreds of subscriber-operators monetizing stolen iPhone hardware through industrialized soc...
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain"]
- Adversary
- null
- Pulse Id
- 6a8fefa73dcdd0e3c18df580
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainapple-unlock.com | — | |
domainbuscar-lphone.com | — | |
domainsuporte-lcloud.com | — | |
domaincom-maps.info | — | |
domainfindmy-dispositivos.com | — | |
domainid-ubicacion.com | — | |
domainfindsupport.live | — | |
domainzu7pl.pro | — | |
domainalxescript.info | — | |
domainanomkit.shop | — | |
domainapple-login-imaps.com | — | |
domainapple-thailand.co | — | |
domaincenter-one.online | — | |
domaingon-unlocker.pro | — | |
domainirealm-server.com | — | |
domainkey-unlock.com | — | |
domainkit-pro-bot.click | — | |
domainprojectpartapple.com | — | |
domainspider-off-unlock.one | — | |
domainb.pro-center.my.id | — | |
domainapple-care-in.com | — | |
domainapple-localise.info | — | |
domainapplelnfo.com | — | |
domainencontrar-dispositivos.cloud | — | |
domainfind-alerts.com | — | |
domainfindmylocalizado.com | — | |
domainfmi-dispositivo.com | — | |
domainfmi-dispositivos.com | — | |
domaini-cloudsd.com | — | |
domainicloud-inc-in.info | — | |
domaininc-locations.support | — | |
domainirealm-server.co | — | |
domainkanoondekho.com | — | |
domainprookit.com | — | |
domainrastreo-devices.com | — | |
domaintrace-apple-in.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash07d4a6ac925f9f7e63c7332df1995de03f514931e9d97cb3dd7a72fecf569e11 | — | |
hash2c790296b404b3e7592da37b15311507b0e55989e1628eef1bb970acb13ec37f | — | |
hash32fa60c9099f53f194a6a63c9341dd115434584e0890120ba1eca83ae33832bf | — | |
hash5ea22f9777a34f461840c2a3988c717c0f9e6ec4bd95420c8643251e28ccc36b | — | |
hashd9e2881d3aa1ea40928dac65405fbe7e36989cad51ab46daf493afff757a2493 | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip196.196.102.74 | — |
Threat ID: 6a90d83bacd9273b49028301
Added to database: 08/28/2026, 00:37:15 UTC
Last updated: 08/28/2026, 03:37:41 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.