AnonyMousKIT is a credit-metered Phishing-as-a-Service platform built to defeat Apple's Activation Lock on stolen iPhones by extracting the three credentials required to disable it: the device passcode, the Apple ID username/password, and a live two-factor authentication code. Operators begin by profiling the stolen device itself — pulling its internal model identifier, Find My/Lost Mode status, and the owner's contact details directly off the handset — to build a credible fraudulent "your device has been found" narrative.

Victims are then pushed through a coordinated, five-channel pressure campaign combining email, SMS, WhatsApp, pre-recorded voice calls, and AI-driven vishing, so that if one channel is ignored another reinforces it. The email leg was largely relayed through a single free Gmail account, noreplyapple00000@gmail.com, disguised as an Apple no-reply sender. Messages and calls direct victims to spoofed Apple/Find My-branded web pages that display an animated device-location map and anti-bot checks before sequentially harvesting the passcode, Apple ID, and a live 2FA code.

The AI vishing component rents commercial conversational-voice infrastructure from Vapi to run five configured personas — all styled "Alice from Apple Support" (one build uses "Alice Dias") — operating in English, Spanish, and Brazilian Portuguese. The script has the agent claim the device was brought into an Apple Store and is being held pending verification, then walks the victim through confirming their four- or six-digit passcode and any SMS security codes. SOCRadar recovered 200 call records (August 31, 2025 – May 30, 2026) with 55 usable transcripts, at a total automation cost of $19.24 (~9.6 cents per call) — a cost low enough that operators had little incentive to pre-qualify targets. None of the 200 analyzed calls resulted in a confirmed passcode capture: 100 victims hung up, 48 hit silence timeouts, 24 did not answer, and 28 hit platform errors.

The platform operates as a three-tier criminal supply chain: developers build and maintain the shared codebase, licensed resellers operate 168 branded storefronts (a reseller/franchise model), and operators run the actual phishing campaigns against theft victims, paying per-channel credits (e.g., 1.50 credits per email, 2 credits per AI voice call). SOCRadar identified 30 distinct backend installations across 42 of the 506 scanned kit-family domains (188 found live), including named clusters UKT (the oldest backend), and the linked i-Realm/KG-KING cluster. Three storefront brands — i-Blocker, Key Unlock, and KG-KING — launched within the same second on 2026-04-10 and shared Gmail relay infrastructure, evidence SOCRadar cites as one buyer operating multiple storefront brands rather than independent customers. A single core AnonyMousKIT deployment logged 691 send attempts (649 delivered) between March and July 2026; the wider 30-backend family reached 6,092 targets, including 64 sends to non-consumer South African government domains, and tracked 5,031 devices as online and 1,035 as locked. Geographic targeting concentrated on Brazil (179 of 200 AI calls; ~90% of the recovered call set) with additional volume into South Africa, Indonesia, Italy, India, and Kenya, and touched government, education, and corporate mail domains.

Successful credential theft gives operators everything needed to disable Activation Lock, factory-reset the device, and remove it from Find My for resale — while also exposing the victim's iCloud backups, iCloud Keychain-stored passwords, and any corporate data or credentials synced to a personally owned or employer-issued handset. The control panel also advertises four proprietary unlock/support binaries (two developed in-house) and references the public USBliter8 bootrom exploit (released 2026-06-18, affecting Apple A12–A13 silicon); SOCRadar assesses these as "bait" add-ons, since USBliter8 requires physical DFU-mode possession and cannot itself recover a passcode or remove Activation Lock — 92.7% of devices in the tracked dataset run A12 silicon or newer, keeping social engineering as the only practical path to unlock.

SOCRadar's Threat Research Unit discovered and mapped the operation via a basic operational-security failure: two bare relative file paths in the platform's shared codebase resolve to the web root and grant unauthenticated HTTP access to production logs and operator rosters. Because every deployment inherits the shared codebase, the flaw exposed operational data across the wider kit family, not just a single storefront. SOCRadar references an operator handle, "Owner OF AnonyMousTeam," advertising the platform, but does not attribute the operation to a named group or nation-state.