AnonyMousKIT uses voice AI agents to phish iPhone passcodes

SOCRadar says the AnonyMousKIT phishing-as-a-service harvests Apple IDs and codes so stolen iPhones can be unlocked and Activation Lock disabled. The kit has been active since early 2024, with 506 domains and 168 reseller storefronts.

Image published with BleepingComputer on AnonyMousKIT’s iPhone Activation Lock phishing

On August 25, 2026 BleepingComputer reported SOCRadar’s findings on AnonyMousKIT, a phishing-as-a-service that uses voice AI agents to steal iPhone passcodes.

What we know

SOCRadar says AnonyMousKIT harvests Apple IDs and codes to unlock stolen iPhones and disable Activation Lock.
The service has been active since early 2024 and uses 506 domains plus 168 reseller storefronts.
Researchers reviewed 200 victim calls from August 2025 through May 2026.
The voice agent offers five personas at about $0.10 per attempt; about 90% of the analyzed calls went to Brazil.
The emails impersonate Find My first, then “Alice” from Apple Support.

Takeaways

The kit is built to defeat Activation Lock on stolen iPhones, not only to steal logins.
Voice AI makes the phone step cheap enough to run at about ten cents an attempt.
The analyzed traffic concentrated on Brazil.

Source: BleepingComputer

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 25, 20263 min read

AnonyMousKIT uses voice AI agents to phish iPhone passcodes

On August 25, 2026 BleepingComputer reported SOCRadar’s findings on AnonyMousKIT, a phishing-as-a-service that uses voice AI agents to steal iPhone passcodes.

What we know

SOCRadar says AnonyMousKIT harvests Apple IDs and codes to unlock stolen iPhones and disable Activation Lock.
The service has been active since early 2024 and uses 506 domains plus 168 reseller storefronts.
Researchers reviewed 200 victim calls from August 2025 through May 2026.
The voice agent offers five personas at about $0.10 per attempt; about 90% of the analyzed calls went to Brazil.
The emails impersonate Find My first, then “Alice” from Apple Support.

Takeaways

The kit is built to defeat Activation Lock on stolen iPhones, not only to steal logins.
Voice AI makes the phone step cheap enough to run at about ten cents an attempt.
The analyzed traffic concentrated on Brazil.

Source: BleepingComputer