An underground marketplace on Telegram facilitates unlocking stolen iPhones despite Apple's Activation Lock. Attackers use SMS phishing with lookalike domains to trick owners into revealing passcodes. Unlocking tools, sold for $5-50, can jailbreak older phones and gather data to improve phishing. Over 10,000 domains linked to these operations have been identified, with a significant increase in DNS traffic. The operation spans multiple countries and focuses on wiping devices for resale rather than data theft.
