AnonyMousKIT: the PhaaS platform that disables Apple's Activation Lock

New PhaaS Platform Bypasses Apple's Activation Lock

AnonyMousKIT, a Phishing-as-a-Service (PhaaS) platform that emerged at the beginning of 2024, automates the recovery of codes to deactivate Apple's Activation Lock, turning iPhone theft into a structured business. The platform, discovered by SOCRadar, exploits vulnerabilities in the configuration of relative paths to expose its infrastructure, revealing an ecosystem of 506 domains and 168 retailer brands.

Quick Response

A Criminal Ecosystem with 168 Retailer Brands

The platform, active since 2024, fuels a black market for stolen iPhones, with a network of 168 brands acting as retailers. SOCRadar recovered logs of 200 calls to victims between August 2025 and May 2026, using 55 different transcripts managed by a vocal AI agent with five distinct identities. Each call costs the operator about 10 cents, with 90% of the calls directed towards Brazil.

How It Bypasses Apple's Activation Lock

Apple's Activation Lock activates with Find My, binding the device to the user's account. Even after a factory reset, the device remains locked without a valid authorization code. AnonyMousKIT recovers information from stolen devices, including owner details provided through [Lost Mode](https://support.apple.com/en-euro/guide/icloud/mmfc0f0165/icloud), to contact victims via email, SMS, WhatsApp, or phone call.

Sophisticated Phishing Techniques with AI Agents

The phishing emails impersonate Apple, claiming that the lost device has been located and providing precise details such as the model and IMEI to appear legitimate. Victims are redirected to fake Find My or Apple pages, where they are asked to enter the device code, Apple Account credentials, and the two-factor authentication code. In some cases, an AI agent with the identity "Alice from Apple Support" informs victims that someone has attempted to unlock the phone at an Apple Store, asking them to confirm ownership by dictating the passcode and redirecting them to the phishing page.

Implications for Personal and Business Data Security

Once the codes are obtained, threat actors can access the victim's personal data, reset the device, and remove it from the Find My app before selling it. A compromised Apple Account can expose iCloud backups, Keychain passwords, business emails, and other business information stored on personal or business Apple devices, as SOCRadar warns. Researchers have detected that a small percentage of emails from the platform were sent to government and business organizations.

Global Impact with a Focus on Emerging Markets

The campaigns facilitated by AnonyMousKIT have a global footprint but are more concentrated in South Africa, Indonesia, Italy, India, Kenya, and Brazil. SOCRadar emphasizes that overall prevention scores can hide what happens after the initial access. Once threat actors use valid credentials, prevention drastically decreases.

The Context of Business Defenses

The Blue Report 2026 measures defenses technique by technique across 338 million simulations executed in client production environments. The report highlights that business defenses can be ineffective once attackers gain initial access with valid credentials, emphasizing the need for more robust, multi-layered security solutions. Apple and other service providers should implement stronger authentication mechanisms that are resistant to phishing attacks. Only through a multifaceted approach will it be possible to effectively counter the continuous evolution of cyber threats.