Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

Summary: SOCRadar's Threat Research Unit documented a credit-metered phishing-as-a-service platform it calls AnonyMousKIT that targets owners of recently lost or stolen Apple devices, using rented AI voice agents posing as Apple Support to request the 4- or 6-digit device passcode, then Apple ID credentials, then a live 2FA code. Researchers recovered 200 call records, 55 transcripts, and five personas all named Alice from Apple Support from an operator account on the voice platform Vapi; the calls ran from August 31, 2025 to May 30, 2026, 179 of the 200 went to Brazil, and the total cost was $19.24, or about 9.6 cents per call.
What's compelling: At roughly 9.6 cents a call, the economics of stealing a phone have changed: the report puts 92.7% of 6,092 targeted devices on A12 silicon or newer, where the checkm8 bootrom exploit does not reach, so the passcode handoff is the unlock path. The report records no count of captured passcodes, Apple IDs, or 2FA codes for any of the five channels, and the platform was still running on the last day of analysis.

Read the original at The Hacker News ↗