Loading story…
Researchers exposed AnonyMousKIT, an AI-enabled phishing-as-a-service platform designed to harvest Apple ID credentials from victims of recent Apple device theft and use those credentials to disable Activation Lock on stolen iPhones and other Apple hardware. The operation automated phishing across email, SMS, WhatsApp, recorded voice messages, and AI-generated voice calls, including Apple-themed social engineering personas such as "Alice from Apple Support" to collect victim identity details and account access needed to compromise devices and associated cloud data.
Analysis of leaked backend logs tied the activity to a broader reseller ecosystem spanning 506 domains, 168 storefront brands, and at least 30 backend installations active since early 2024, with multiple storefronts linked to a shared codebase and likely common developer. Researchers said coding flaws exposed operator activity and infrastructure, showing a mature supply chain behind the service and underscoring the wider enterprise risk: stolen Apple IDs can provide access not only to hardware but also to iCloud backups, Keychain credentials, and potentially sensitive work-related information.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
The report states AnonyMousKIT remained active through August 2026, with panel logs showing operator activity continuing on August 10, 2026.
The exposed VAPI.ai artifacts showed the AI voice campaign placed 200 calls between August 31, 2025 and May 30, 2026, with the last logged calls occurring on May 30, 2026.
The i-Blocker, Key Unlock, and KG-KING storefronts launched in the same second and shared Gmail relay accounts. SOCRadar assessed the three brands as likely operated by a single buyer.
Within AnonyMousKIT itself, researchers observed 691 email send attempts between March and July 2026, with 603 messages reaching victims' inboxes. The emails impersonated Apple and used multiple lure domains, subject lines, and templates.
Artifacts from a VAPI.ai account showed the AI voice channel placed calls as part of the campaign, with the first logged calls occurring on August 31, 2025. The voice operation used configured personas to target victims, primarily in Brazil.
Researchers linked the broader phishing kit family to 506 domains and 168 storefront brands that were active since February 2024, indicating the reseller ecosystem was already operating by that month.
A coding error exposed AnonyMousKIT production logs and operator records, enabling researchers to identify 30 backend installations across 42 domains and observe 41 active backends in the broader family. The findings also identified related infrastructure, relay accounts, IP addresses, and other indicators tied to the reseller ecosystem.
Mirage Security reported on p1bot, a vishing platform that weaponizes ElevenLabs for voice-phishing operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
13 references tracked. Mallory keeps watching after this page renders.
moonlock.com
Open sourcecysecurity.news
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcesocradar.io
Open sourceinfoblox.com
Open sourceattack.mitre.org
Open sourcemiragesecurity.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **iAuthFlow V2**, a phishing toolkit advertised on a Russian-language cybercrime forum, can hijack a victim’s successful login and silently register an attacker-controlled passkey on the compromised account. The toolkit reportedly uses a browser-in-the-middle relay to capture credentials and authentication responses during a phishable sign-in flow, then authenticates an attacker-controlled browser session to enroll the new passkey. Demonstrations analyzed by Abnormal focused on **Google** accounts, where victims entered a password and authenticator-app code while the attacker gained a persistent credential tied directly to the account. The reported persistence means attackers may be able to regain access even after a password reset and session revocation, because the enrolled passkey remains valid unless it is explicitly removed. The seller also advertised modules for **Microsoft, iCloud, and LinkedIn**, with pricing reportedly starting at **$10,000** plus add-ons. Researchers said their findings were based on forum posts, Telegram content, demonstration videos, and vendor documentation rather than direct execution of the toolkit, and warned that incident response for such compromises should include checking for unauthorized **passkeys**, **OAuth grants**, and malicious mailbox rules instead of relying solely on password changes.
Aug 24, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026
Attackers are increasingly leveraging simple yet effective phishing and social engineering tactics to steal user credentials. One observed method involves sending phishing emails with malicious attachments, such as `.shtml` files, that present fake login screens to unsuspecting victims. These screens are designed to capture any credentials entered and immediately transmit them to attackers via Telegram bots, making detection and takedown more difficult. The phishing campaigns often use compromised legitimate email accounts and minimal social engineering, relying on the likelihood of password reuse across multiple sites to maximize the value of stolen credentials. Another prevalent technique targets iPhone owners whose devices have been lost or stolen. Scammers exploit the contact information displayed on the device's lock screen to send convincing messages that mimic Apple's Find My service, tricking victims into entering their Apple ID credentials on fake websites. With these credentials, attackers can unlock, wipe, and resell the devices, as well as access sensitive personal data. These attacks highlight the ongoing evolution of credential theft tactics, emphasizing the need for vigilance against both low-sophistication phishing and more targeted social engineering schemes.
Jul 12, 2026