AnonyMousKIT: the PhaaS platform that disables Apple's Activation Lock

KEY TAKEAWAYS

• AnonyMousKIT automates the theft of Apple credentials to disable the Activation Lock
• The platform has been active since 2024 and manages a criminal ecosystem with 506 domains and 168 retailer brands
• SOCRadar recovered logs of 200 calls to victims between August 2025 and May 2026
• The service exploits AI agents with 55 distinct transcriptions to deceive victims
• The phishing messages impersonate Apple and use specific details such as model and IMEI to appear legitimate