Why a stolen iPhone needs its owner's help
A stolen iPhone is close to worthless to a thief while Apple's Activation Lock is switched on. That single fact has kept a criminal cottage industry alive for years: phishing campaigns built entirely around getting the phone's real owner to unlock it for someone else. Researchers at SOCRadar have now documented a service that automates the most convincing part of that con - a live phone call - using AI-generated voices, and sells it as a subscription product.
The service is called AnonyMousKIT, and according to SOCRadar it has been running since early 2024.
How the call reaches you in the first place
When an iPhone is reported lost or stolen, its owner can put it into Lost Mode through Find My, which displays a contact number or message on the locked screen. AnonyMousKIT's operators use exactly that information to reach the victim - by phishing email, text message, WhatsApp message, or a direct phone call from an AI voice agent posing as Apple support.
SOCRadar recovered 200 documented calls placed between August 2025 and May 2026, drawn from 55 distinct AI-voice transcripts. The operation runs five personas; the one that shows up most often introduces herself as "Alice from Apple Support" and speaks Portuguese.
What the call is actually trying to get
The goal isn't the passcode alone. A caller who reaches a victim tries to either get the device passcode dictated directly, or steer the person to a fake Apple ID or Find My login page. From there the operation harvests the victim's Apple ID credentials along with a live two-factor authentication code, and routes it immediately to the operator's Telegram channel or control panel. With that in hand, the thief can strip Activation Lock from the device and put it back into the resale market.
The scale behind one phishing kit
SOCRadar's investigation found the infrastructure behind AnonyMousKIT spans 506 domains and 168 separate reseller "storefront" brands - evidence that this isn't one operator working alone but a kit resold to other criminals. Running each call costs the operation roughly $0.10, which is cheap enough to make mass targeting viable rather than reserved for high-value marks.
Geographically, the calling pattern is lopsided: about 90 percent of the documented calls went to victims in Brazil, with the remainder spread across South Africa, Indonesia, Italy, India, and Kenya.
Why the AI voice matters here
Text-based Apple phishing is old news, and most people have learned to be suspicious of a text claiming their lost phone was found. A live call from someone who sounds like a real support agent, who can respond naturally to questions and adapt mid-conversation, is a different psychological proposition - and AI voice generation is what makes running that at the scale of hundreds of calls, across five personas and multiple languages, commercially viable rather than labor-intensive.
What to do if your iPhone is stolen
- Report it lost through Find My immediately, but understand that the contact information you display in Lost Mode can be used to target you directly.
- Apple and its carriers do not call you to "verify" a passcode or ask you to read back a two-factor code over the phone. Any call doing so is not legitimate, regardless of how convincing the voice sounds.
- Never enter your Apple ID credentials on a page reached through a link sent by SMS, email, or WhatsApp in connection with a lost device. Go directly to apple.com or the Find My app instead.
- If you receive a suspicious call about a lost or stolen device, hang up and report it through Apple's official channels rather than calling back a number the caller provided.
What it means in practice
The underlying scam - phish the owner to strip Activation Lock - isn't new. What AnonyMousKIT shows is that AI voice generation has moved from novelty to infrastructure in ordinary cybercrime, sold as a kit with reseller branding rather than built bespoke by each criminal group. For readers, the practical defense hasn't changed: no legitimate Apple contact will ever ask you to speak your passcode or read out a two-factor code, no matter how the request is delivered.
