A pay-per-use scam operation is renting AI voice callers that pose as Apple Support to pry passcodes out of people whose devices were just stolen.
SOCRadar’s Threat Research Unit tracks the service as AnonyMousKIT, a phishing-as-a-service platform built to break Activation Lock on stolen iPhones. Operator accounts spend credits across five channels, priced per contact, with the AI caller the priciest at two credits. Victims are walked through a fixed script: the device passcode, then Apple ID credentials, then a live two-factor authentication code. Every lure leans on identifiers pulled from the stolen handset itself, and victims land on a page dressed in Apple branding that animates the phone’s last known location on a map.
Most of the evidence trails the voice channel. Researchers recovered 55 transcripts and 200 call recordings from the operator’s workspace on the commercial voice platform Vapi, where five personas were set up, each answering as Alice from Apple Support. Brazil absorbed 179 of the 200 calls, placed between August 2025 and May 2026. The combined bill for the whole campaign was $19.24, under ten cents per call.
The report stops short of counting stolen passcodes or codes. Access to the operator’s logs came from two relative file paths in the kit’s shared codebase, and a sweep of 506 related domains found 30 installations live on 42 hosts. Apple’s guidance is direct: support never asks for a password, passcode or 2FA code.
