- Published on
Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes
- Authors
- Name
- DeepHorus
Cybersecurity researchers have uncovered a sophisticated phishing-as-a-service (PhaaS) platform called AnonyMousKIT, which exploits AI voice agents to target owners of stolen Apple devices. The service, detailed by SOCRadar Threat Research Unit, uses automated calls impersonating Apple Support to trick victims into surrendering device passcodes and authentication details. This development represents a significant evolution in social engineering tactics, leveraging affordable AI to scale fraud operations against Apple's Activation Lock security feature.
Activation Lock, a theft-deterrent introduced in iOS 7, binds an iPhone or iPad to its owner's Apple ID, rendering the device unusable without the account credentials. Criminals have long sought methods to bypass this protection, and AnonyMousKIT provides a turnkey solution. The platform is marketed as a complete criminal business, offering credit bundles, tiered subscriptions, and customer support to its users.
The PhaaS system is credit-metered and multi-channel, with AI voice calls priced at 2 credits each. Researchers recovered 200 call records, 55 transcripts, and five personas from the operator's account on the commercial voice platform Vapi. The calls, primarily targeting Brazilian numbers, employed personas like "Alice from Apple Support" and ran from August 2025 to May 2026.
In the attacks, the AI agent requests the victim's 4- or 6-digit device passcode, then Apple ID credentials, and finally a live two-factor authentication code. This information is used to remove the Activation Lock, allowing the stolen device to be resold. Researchers estimate the cost for 200 automated calls was only $19.24, or about 9.6 cents per attempt, highlighting the low barrier to entry for this form of fraud.
The investigation also revealed a critical security flaw. Unauthenticated access to the platform's codebase allowed researchers to view logs from multiple installations. They identified 30 distinct backends across 42 domains, which collectively logged over 6,000 phishing send attempts between March and July 2026.
While the report does not specify how many victims were successfully compromised across all channels, it notes the AI voice calls had a mix of outcomes, with 100 victims hanging up. The lures used subject lines like "Your device has been found" and spoofed official Apple display names. This scalable, AI-driven approach presents a new challenge for consumer security and underscores the importance of heeding Apple's official guidance, which states the company never asks for passwords or passcodes during support interactions.
