Sep 26, 2026 · 29 min
AI phishing kits turn stolen iPhones into identity attacks
An apple a day, a phish away. [Research Saturday]
Anonymous Kit shows how automation, multichannel lures, and AI voice calls can turn a stolen Activation-Locked device into a broader account-compromise risk.
- 1Anonymous Kit packages phishing infrastructure, hosting, messaging, and credential collection for criminals with limited technical skills.
- 2Attackers target stolen Apple devices through tailored email, SMS, WhatsApp, and AI-generated voice calls impersonating support.
- 3A stolen corporate iPhone requires both physical-security and identity-security response, including wiping, session revocation, and account review.
Don't miss
Şeker explains how developer mistakes exposed a sprawling Anonymous Kit ecosystem despite its sophisticated AI-driven attack workflows.
The brief
Ensar Şeker of SOC Radar examines Anonymous Kit, an AI-powered phishing-as-a-service operation that helps criminals build campaigns without mastering the underlying infrastructure.
The service targets stolen Apple devices protected by Activation Lock, guiding criminals from identifying the owner to sending tailored lures designed to capture account credentials.
Email and SMS are only the beginning: Anonymous Kit extends the attack through WhatsApp and AI-generated voice calls or deepfakes impersonating Apple support.
The investigation found a striking mismatch between sophisticated conversational AI and basic developer errors, which exposed domains, storefronts, backend systems, and resellers.
The practical lesson is to treat a stolen corporate iPhone as an identity-security incident too: lock or wipe it, revoke sessions, and review account activity.