Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

Cybersecurity researchers have disclosed details of a phishing-as-a-service (PhaaS) platform designed to bypass Apple's Activation Lock on stolen devices. The platform, tracked as AnonyMousKIT by SOCRadar Threat Research Unit (STRU), leverages rented AI voice agents to call theft victims while impersonating Apple Support. The callers request the device passcode and two-factor authentication (2FA) codes, which are then used to unlock the device and remove Activation Lock, allowing the stolen device to be resold.

The service operates on a credit-metered basis, suggesting a commercial model where threat actors pay for usage. The lures are designed to trick victims into believing they are speaking with legitimate Apple representatives, exploiting trust in official support channels. The exact method of obtaining the codes is not fully detailed in the available information, but the approach highlights a growing trend of AI-enabled social engineering in cybercrime.

This development underscores the evolving tactics of cybercriminals, who are increasingly adopting AI tools to enhance the credibility and effectiveness of phishing campaigns. The impact on victims extends beyond the loss of the device itself, as the compromise of passcodes and 2FA codes can lead to further privacy breaches and financial loss.