Researchers identified AnonyMousKIT, a phishing-as-a-service platform built to bypass Apple’s Activation Lock on stolen devices, using AI voice agents (all posing as “Alice from Apple Support,” running on the commercial Vapi voice platform in English, Spanish, and Portuguese) to trick victims into handing over passcodes, Apple ID credentials, and two-factor codes, information Apple says it never asks for.
You can find more details here: AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
Gidi Cohen, CEO & Co-Founder, Bonfy.AI:
“The real story here isn’t that AI can impersonate Apple Support convincingly, it’s how cheap that’s become. $0.096 a call gets you a voice agent that can run the whole script in three languages: ask for the passcode, then the Apple ID, then a live 2FA code. That used to take a skilled scammer sitting on the phone. Now it’s a rented service with published pricing and customer support. AI didn’t invent this scam, it just took the labor cost out of it, and that changes who can run one and how many they can run at once.
It’s also a good reminder that the backend behind these operations is usually way messier than the polished lure emails suggest. Researchers got into months of call logs, transcripts, and persona configs because of two exposed file paths, not some clever hack. Even the people running these platforms don’t seem to have much visibility into their own exposure.
But the part worth actually worrying about isn’t stolen phones, it’s what happens when this same trick gets pointed at employees instead of consumers. Cheap, real-time voice AI means help-desk calls, vendor calls, password-reset calls are all about to get a lot harder to sniff out just by listening. If a fake “Apple Support” agent can talk someone out of a 2FA code for pennies, the same setup works just as well faking IT support to get into a company. Security teams need eyes on how AI is being used against them, not just how it’s being used inside their own walls.”
Apple users need to be alive to this threat along with many other threats. Because there will always be a new threat that users need to keep their eyes out for.
Related
This entry was posted on August 26, 2026 at 2:43 pm and is filed under Commentary with tags Apple. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
A phishing-as-a-service platform now uses AI voice agents posing as “Apple Support” to unlock stolen iPhones, for under 10 cents a call
Researchers identified AnonyMousKIT, a phishing-as-a-service platform built to bypass Apple’s Activation Lock on stolen devices, using AI voice agents (all posing as “Alice from Apple Support,” running on the commercial Vapi voice platform in English, Spanish, and Portuguese) to trick victims into handing over passcodes, Apple ID credentials, and two-factor codes, information Apple says it never asks for.
You can find more details here: AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
Gidi Cohen, CEO & Co-Founder, Bonfy.AI:
“The real story here isn’t that AI can impersonate Apple Support convincingly, it’s how cheap that’s become. $0.096 a call gets you a voice agent that can run the whole script in three languages: ask for the passcode, then the Apple ID, then a live 2FA code. That used to take a skilled scammer sitting on the phone. Now it’s a rented service with published pricing and customer support. AI didn’t invent this scam, it just took the labor cost out of it, and that changes who can run one and how many they can run at once.
It’s also a good reminder that the backend behind these operations is usually way messier than the polished lure emails suggest. Researchers got into months of call logs, transcripts, and persona configs because of two exposed file paths, not some clever hack. Even the people running these platforms don’t seem to have much visibility into their own exposure.
But the part worth actually worrying about isn’t stolen phones, it’s what happens when this same trick gets pointed at employees instead of consumers. Cheap, real-time voice AI means help-desk calls, vendor calls, password-reset calls are all about to get a lot harder to sniff out just by listening. If a fake “Apple Support” agent can talk someone out of a 2FA code for pennies, the same setup works just as well faking IT support to get into a company. Security teams need eyes on how AI is being used against them, not just how it’s being used inside their own walls.”
Apple users need to be alive to this threat along with many other threats. Because there will always be a new threat that users need to keep their eyes out for.
Share this:
Like this:
Related
This entry was posted on August 26, 2026 at 2:43 pm and is filed under Commentary with tags Apple. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.