New 'AnonyMous' phishing campaign targets iPhone users with fake AI Apple support calls

SOCRadar uncovers AnonyMousKIT, a phishing kit abusing Apple’s Lost Mode contact info Crooks spoof Find My pages, trick victims into giving credentials to unlock stolen iPhones Active since 2024, it operates like a criminal software business with 500+ domains and AI‑driven vishing Security researchers have discovered AnonyMousKIT, a new phishing kit designed to bypass the last line of defense for stolen iPhones, which has been in use for more than two years.

Apple devices come with several anti-theft mechanisms working together to make iPhones a lot less attractive to thieves, including Find My, Activation Lock, and Lost Mode.

If a user’s device is lost or stolen, they can use their tablet, laptop, or a similar device to enable Find My iPhone, which can then locate the device through an app or a website.

They can also see its location on a map, make it play a sound, remotely wipe it, or receive a notification when it’s found.

Enabling the Find My feature also turns on Activation Lock, which locks the phone and prevents it from being set up by someone else.

Even if the thief factory resets it, the phone remains connected to the real owner’s Apple account, and they simply can’t set it up.

To do that, they would need the iPhone device passcode to exit Lost Mode, and the Apple account password, if Activation Lock/setup authentication is required.

But there is another feature Apple added, just in case the device isn’t actually stolen, but rather lost.

For these occasions, there is an option to display the owner’s contact information on the screen so that a good samaritan who finds it can return it to its rightful owner.

As is the case with many other well-intended features, this one is now also being abused as part of the AnonyMousKIT phishing kit .

This is why we can't have nice things According to security researchers SOCRadar, crooks are using AnonyMousKIT to create fake Find My or Apple pages.

Then, they use the contact information displayed on the stolen iPhone to reach out to the victim.

Through the kit, they can send emails, SMS messages, WhatsApp texts, or even AI-powered phone calls.

Reaching out to the victim, the attackers introduce themselves as Apple customer support agents, and tell the victim their smartphone had been retrieved.