AnonyMousKIT phishing service targets Apple credentials and Activation Lock

A new phishing-as-a-service (PhaaS) ecosystem, known as AnonyMousKIT, has emerged, enabling criminals to steal Apple credentials and bypass the Activation Lock feature on stolen devices, according to the SOCRadar Threat Research Unit. This sophisticated platform leverages a combination of phishing emails, SMS, WhatsApp messages, recorded calls, and AI-powered voice agents, operating on a credit-based system for its users, based on information published by Cyber Insider.

AnonyMousKIT is specifically designed to circumvent Apple's Activation Lock, a security measure that links an Apple device to its owner's Apple ID, making stolen devices difficult to resell. The service allows criminals to obtain owner credentials, passcodes, and two-factor authentication codes. Operators input stolen device details and victim contact information to initiate social-engineering attacks across multiple channels. Researchers identified thousands of phishing emails targeting devices, with victims encountering convincing Apple-themed pages that request passcodes, Apple ID credentials, and 2FA codes. The platform also integrates AI for voice phishing, with automated agents impersonating Apple Support to trick users into revealing passcodes and clicking phishing links.

While the service is advanced, basic coding errors exposed its operations, allowing researchers to link numerous domains and backend installations. The compromise of Apple IDs can lead to access to sensitive data beyond just the device itself, including iCloud backups and credentials. Apple users are advised to be wary of unsolicited communications and to access device recovery services directly through official Apple channels.

Source: Cyber Insider