Executive Summary
AnonyMousKIT is a sophisticated Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple's Activation Lock on stolen devices. Operating as a credit-metered platform, it automates credential harvesting through a multi-channel pipeline including email, SMS, WhatsApp, and advanced conversational AI voice agents (vishing). SOCRadar's investigation revealed a decentralized supply chain involving at least 506 domains and 30 distinct backend installations active since early 2024.
The platform's primary innovation is the integration of LLM-driven voice agents that mimic 'Apple Support' to trick victims into surrendering device passcodes and 2FA codes. While targeted at individual device owners, the theft of Apple IDs poses a significant institutional risk by exposing iCloud backups, Keychain credentials, and synchronized corporate data. Despite the use of modern AI, the kit's infrastructure was compromised by basic coding errors—specifically bare relative paths—which exposed production logs and operator rosters to researchers.
Key Details
Threat Name
AnonyMousKIT PhaaS Platform
Affects
—
Adversary
AnonyMousTeam Other Adversaries and Aliases: Cluster B; UKT
MITRE Techniques
Malware/Tools
AnonyMousKIT, palera1n, winra1n, i-Realm, PRO KIT, Painel-Rescue Unlocker, ULTIMATE KIT V5, iRemovalKIT, AppleChecker