AI agent “Alice from Apple Support” tricks theft victims into handing over their device passwords

Analysts at SOCRadar's Threat Research Unit have laid bare the workings of AnonyMousKIT, a platform built to remove the Activation Lock from stolen Apple devices. The researchers describe it not as an ordinary phishing kit but as a small software business with a criminal clientele: credit bundles, published pricing, tiered subscriptions, customer support, status tracking and infrastructure-rotation playbooks.

The attack works like this. Victims whose device has recently gone missing or been stolen are hit with lures across five channels at once — email, SMS, WhatsApp, a recorded call and, finally, an AI voice agent (the most expensive channel, at 2 credits per contact). The messages reference the internal model identifier of the specific handset and its current status in Find My — data pulled from the stolen device itself. Following the link takes the person to a page under the Apple brand with an animated “location” map of the phone.

From there the victim is walked, step by step, into surrendering the 4- or 6-digit passcode, their Apple ID credentials and, finally, a live two-factor authentication code. Yet Apple's own documentation explicitly warns that the company will never ask for a password, a device passcode or a 2FA code.

“Alice from Apple Support”

The voice channel is built on the commercial Vapi platform. From the operators' account, investigators recovered 200 call recordings, 55 transcripts and five configured personas — all under the single name “Alice from Apple Support,” in English, Spanish and Portuguese. The calls ran from August 31, 2025 to May 30, 2026, with 179 of the 200 placed to Brazilian numbers. In one transcript the agent asks the victim to confirm ownership, reads the dictated passcode back for verification and claims that someone came into an Apple Store to remove the lock. All 200 calls cost a total of $19.24 — roughly 9.6 cents apiece.

Tellingly, the “unlock tools” offered on the dashboard are just bait. The checkm8 exploit only works on the A5–A11 chips, whereas 92.7% of the targeted devices carry A12 silicon or newer. The technical bypass is dead, so the only real route to unlocking is to wheedle the passcode out of the owner and intercept the 2FA in real time. It is precisely this automated, LLM-based voice channel that the researchers call the platform's chief innovation.

The logs leaked to SOCRadar through file paths left in the shared code and open to unauthenticated access — a vulnerability that every copy of the kit inherits. Scanning turned up 30 installations across 42 domains. As a defense, the analysts recommend moving valuable Apple IDs onto hardware security keys: this fully shuts down the one-time-code interception that the whole scheme is designed around. Apple did not respond to a request for comment.

Source: The Hacker News