AI-Powered PhaaS Supply Chain

AnonyMousKIT is a sophisticated Phishing-as-a-Service platform leveraging AI to disable Apple's Activation Lock on stolen devices. It uses multi-channel automated credential harvesting methods including email, SMS, WhatsApp, and AI-driven voice phishing calls. The platform's supply chain includes 506 domains and 168 storefront brands, active since early 2024. It targets stolen Apple device owners with device-specific lures using internal model identifiers and real-time Find My status data. AI conversational agents impersonate Apple Support to conduct vishing operations, with over 200 calls primarily targeting Brazil. Coding vulnerabilities exposed extensive operational logs, revealing detailed attack infrastructure and hundreds of WhatsApp operator accounts. The ecosystem functions as a decentralized enterprise involving multiple roles monetizing stolen hardware.

The threat enables attackers to bypass Apple's Activation Lock, facilitating unauthorized use or resale of stolen Apple devices. The multi-channel credential harvesting and AI-driven vishing increase the scale and effectiveness of phishing attacks. The exposure of operational logs reveals the scale and sophistication of the infrastructure, potentially aiding defenders. The platform's decentralized structure and reseller supply chain complicate disruption efforts. The primary impact is on owners of stolen Apple devices, particularly in Brazil, where the majority of vishing calls are placed.

No official patch or remediation is applicable as this is a criminal phishing campaign rather than a software vulnerability. Mitigation should focus on user awareness about phishing attempts, especially AI-driven voice phishing impersonating Apple Support. Organizations and individuals should be cautious of unsolicited communications requesting credentials or device information. Law enforcement and platform operators should monitor and disrupt the reseller supply chain and associated domains. There is no vendor patch available for this threat.