CampaignPublished 6 Nov 2026

Lookalike Domains Expose the iPhone Theft Economy

Source AlienVault OTX General

Description

An underground marketplace on Telegram facilitates unlocking stolen iPhones despite Apple's Activation Lock. Attackers use SMS phishing with lookalike domains to trick owners into revealing passcodes. Unlocking tools, sold for $5-50, can jailbreak older phones and gather data to improve phishing. Over 10,000 domains linked to these operations have been identified, with a significant increase in DNS traffic. The operation spans multiple countries and focuses on wiping devices for resale rather than data theft.

Impact

The campaign undermines Apple's Activation Lock by tricking legitimate iPhone owners into providing passcodes via phishing, enabling thieves to unlock and wipe stolen devices for resale. This increases the profitability of iPhone theft globally. While the primary impact is financial loss due to theft and resale, the campaign also facilitates ongoing phishing attacks through information gathered from jailbroken devices. There is no direct evidence of widespread data theft; the focus is on device unlocking and resale.

Defensive guidance

No official patches or fixes apply as this is a criminal campaign rather than a software vulnerability. Mitigation focuses on user awareness to recognize and avoid SMS phishing attempts, especially those involving lookalike domains. Organizations and individuals should educate users about verifying URLs and not sharing passcodes. Monitoring and blocking known malicious domains associated with this campaign can reduce exposure. Since this is a social engineering and phishing campaign, technical controls such as SMS filtering and domain reputation services may help mitigate risk.

Summary

This campaign involves a global underground marketplace primarily operating via Telegram that enables the unlocking of stolen iPhones, circumventing Apple's Activation Lock security. Attackers employ a combination of technical unlocking tools and social engineering through SMS phishing campaigns using lookalike domains to deceive legitimate owners into surrendering their passcodes. The unlocking tools, available on a pay-as-you-go basis, can jailbreak older iPhone models and extract information to craft more convincing phishing attacks. Analysis identified over 10,000 domains associated with these activities, with DNS traffic increasing by 350% in 2025. The sellers operate from countries including Bangladesh, India, Pakistan, Venezuela, Mexico, and Brazil. The ecosystem prioritizes wiping devices quickly to enable resale on black markets, where unlocked high-end phones can fetch hundreds of dollars. The campaign includes indicators such as domains mimicking Apple services to facilitate phishing.

Lookalike Domains Expose the iPhone Theft Economy

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Domains 4

Community reviews

Description

AI analysisMachine-generated, updated 6 Nov 2026, 19:35 UTC

MITRE ATT&CK techniques21 from threat tags

Technical details

Indicators of compromise

Domains 4

Community reviews

Related threats