AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

AnonyMousKIT is a phishing-as-a-service (PhaaS) platform that leverages voice AI agents to conduct social engineering attacks aimed at retrieving passcodes and Apple ID credentials from victims. It exploits Apple's Activation Lock feature by impersonating Apple support and sending phishing messages that appear legitimate, including accurate device details. Victims are contacted via email, SMS, WhatsApp, or phone calls, where AI personas engage them to disclose passcodes and two-factor authentication codes. The platform has been active since early 2024, with a sprawling infrastructure of over 500 domains and 168 reseller storefronts. Researchers documented 200 calls with AI agents between August 2025 and May 2026, mostly targeting Brazil. Successful credential theft allows attackers to unlock stolen iPhones, disable Activation Lock, access iCloud backups, and harvest sensitive personal and corporate information. The campaign has a global reach but is concentrated in specific countries. The platform operates at low cost per call and uses automation to scale attacks.

The threat enables attackers to bypass Apple's Activation Lock by phishing victims for passcodes and Apple ID credentials, allowing stolen iPhones to be unlocked and resold at higher value. Compromised Apple IDs expose iCloud backups, Keychain passwords, and potentially corporate data stored on Apple devices. The phishing campaigns have a global footprint with concentration in Brazil and other countries. The platform's automation and use of voice AI agents increase the scale and efficiency of attacks. This results in significant privacy and financial risks for victims, including loss of device control and exposure of sensitive personal and corporate information.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Users should be aware of phishing attempts impersonating Apple support and avoid providing passcodes, Apple ID credentials, or two-factor authentication codes in response to unsolicited communications. Organizations should educate users about this specific phishing technique involving voice AI agents and verify any device-related alerts directly through official Apple channels. Monitoring for suspicious activity on Apple accounts and enabling strong authentication methods can help reduce risk. Since this is a service operated outside of Apple, remediation depends on user vigilance and incident response to compromised accounts.