Anonymous MousKIT phishing platform identified to remove Activation Lock on iPhone and iPad

Cybersecurity researchers have documented a phishing platform as a service aimed at eliminating the protection of Activation Lock from stolen iPhones and iPads, combining forged web pages and automatic voice agents with artificial intelligence to deceive victims. The public analysis comes from the SOCRadar Threat Research Unit (STRU) team and describes a product marketed to criminals: panels with credit prices, multiple contact channels and tools to manage campaigns against lost or stolen devices.

Confirmed facts: SOCRadar identified a family of kits that tracks as AnonyMousKIT, with an architecture that allows shooting campaigns from a single victim record to five vectors (email, SMS, WhatsApp, recorded and called with AI voice agent). The platform is "credit-metered": each action has a credit cost (e.g. mail 1.50 credits, call with agent AI 2 credits). The researchers recovered 200 automatic call records between August 31, 2025 and May 30, 2025, of which 179 went to numbers in Brazil; the total estimated cost for those 200 calls was $19.24 ($0.096 per call). SOCRadar also registered 691 shipments from an AnonyMousKIT facility between March and July 2026 and counted 6,092 shipments in 30 related backends within the kit family.

How it works technically (confirmed by the report): operators integrate data extracted from the stolen device - such as the internal model identifier and the state in Find My - into custom lures. The victim receives a link to a falsified page with official appearance that shows an animated map of the reported location of the device and requests, in order, the device unlocking code (4 or 6 digits), the Apple ID credentials and a two-factor authentication code (2FA) received in real time. In the voice branch, TTS (text-to-voice) agents are used with prepared identities ('Alice from Apple Support' in several languages) that simulate support calls and ask to confirm the password in voice.

Verified aspects of the campaign: most emails used issues such as "Your device has been found" and "Alert," and in hundreds of shipments the sending address appeared to be Apple; much of the mail came out of free Gmail accounts controlled by the kit. One scan detected hundreds of family domains (506 labels with 188 live and 30 different facilities detected in 42 domains), and operators published commercial panels with store names (e.g. i-Blocker, Key Unlock, KG-KING) that share infrastructure.

What is still unconfirmed or uncertain: the report does not document a public count of credentials or 2FA codes actually captured in these interactions; the public metrics on campaign results in the sample of 200 calls indicate that 100 hung, 48 ended by time of silence, 24 did not answer and 28 hit with platform errors or occupied lines. There is no public evidence in that report that the voice provider's commercial account (identified as Vapi in the records found) has been reported or deactivated; SOCRadar does not state whether the operations are still active at this time and noted that it will continue to track changes.

Key technical context and limitations: Activation Lock links the hardware to an Apple ID from iOS 7, which prevents use if the owner's account is not removed. The research highlights that most of the objectives - more than 92% in the wide sample - are devices with A12 or later chips, which indicates that the authors do not depend on old public exploits (e.g. checkm8 affects A5-A11). Although a bootrom explosion was published for A12 / A13 in June 2026, its authors describe that it requires physical access, DFU mode (tethered) and does not dismount the safe enclave or recover the passcode; therefore, the realistic technical way to skip Activation Lock at a distance remains limited. The conclusion: the most exploitable link with the most impact is real-time social engineering to extract passcodes and 2FA codes.

Practical implications: the most dangerous innovation is the automation of viewing with language models and TTS integrated into a commercial tool. This reduces implementation costs and allows scale campaigns for victims of theft, making trade in stolen devices profitable. For victims, the most immediate exposure does not come from a technical failure in the hardware, but from revealing the unlocking code and 2FA to an interlocutor that seems legitimate in real time.

Specific recommendations for users (immediate action): never provide your device code (password), Apple ID password or 2FA codes by phone, SMS or via web forms. Apple publicly states that it never requests passwords, device codes or 2FA codes for support; if you receive suspicious communications, send them to reporting @ apple.com and contact Apple via official channels (see your account on applid.apple.com or support from the official app or website). Change the Apple ID password if you suspect that there has been exposure and review active devices and sessions from the Apple ID management page. In addition, ask the mobile operator to block the SIM to avoid port-out and disable or remove trust numbers if they have been compromised.

Stronger mitigation measures (recommended by experts and cited by researchers): migrate high-risk Apple accounts to physical security keys (hardware security keys, FIDO2 / WebAuthn), since these keys prevent the interception attack of 2FA in real time that the platform pursues. Activate verification in two steps with physical keys where possible, use long and unique passwords, and consider enabling white list of devices and security alerts. If your device was stolen, put the device in Lost Mode and follow official instructions for remote deletion only as a last resort; document the robbery for police reporting and keep any evidence of fraudulent communications.

More extensive implications: the marketing of criminal tools with panels, prices, support and infrastructure replacement reduces the entry barrier for minor actors and atomizes the threat. The combination of vectors (email, SMS, messaging, recorded calls and AI calls) allows victims to be persecuted on their preferred channel. As a community-level precaution, voice and messaging service providers should improve controls against commercial abuse of their APIs and TTS platforms should have policies and mechanisms to detect and block false identities that imitate official support.

Useful sources and resources: the technical analysis was published by SOCRadar (see its portal for reports and updates) and Apple itself maintains guidelines for reporting phishing and recommendations on what not to share with support (see Apple's official support on phishing). To understand the historical limitations of bootrom exploits, resources such as the community behind the check document the extent of previous vulnerabilities and why not all generations of chips are susceptible to the same type of attack.

Reference links: SOCRadar (threat investigation and monitoring) - https: / / socradar.io /; Apple's guide on how to report phishing and what not to share - https: / / support.apple.com / en-us / HT204759; historical information about bootrom exploits and associated tools - https: / / checkra.in /.