Threat · curated 25 Aug 2026
AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
First reported bleepingcomputer.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
AnonyMousKIT shows criminals operationalizing autonomous voice AI agents at scale for cheap, multi-persona social-engineering campaigns, lowering the cost and raising the believability of credential-phishing attacks.
AnonyMousKIT, a phishing-as-a-service platform active since early 2024, uses voice AI agents operating under five personas to call victims and phish the passcodes and Apple Account credentials needed to unlock stolen iPhones and disable Activation Lock. SOCRadar researchers linked the operation to 506 domains and 168 reseller storefronts, recovering 200 call records and 55 transcripts, with calls costing about $0.10 each and 90% directed at Brazil.