The attack chain appears to begin with traditional phishing or social engineering to collect the victim’s Apple ID credentials. Once the attacker has that information, AnonyMousKIT initiates a fraudulent call. The AI-driven voice agent convinces the target that their account has been compromised and that they must verify their identity by repeating a one-time passcode. That passcode, once harvested, is used to remove the device from the owner’s iCloud account, effectively unlocking it for resale or reuse.

Key technical characteristics of the platform:

• Uses voice AI to mimic human interaction, reducing the need for live operators.
• Targets Apple Activation Lock, a security feature designed to prevent stolen iPhones from being reactivated.
• Relies on passcode phishing to complete the unlock process, rather than exploiting a hardware or software flaw.
• Operates as a service, meaning less-skilled criminals can purchase access to the tooling without building it themselves.

While the article does not mention a specific CVE or Apple advisory ID associated with this campaign, the method highlights a growing trend: attackers bypassing technical security controls through social engineering rather than code-level exploits. For defenders, the key takeaway is that users should be reminded that Apple will never request a passcode or verification code over an unsolicited phone call.

Source: BleepingComputer

Has your organization seen an increase in AI-driven voice phishing attempts, and how are you training users to verify unsolicited phone calls?