Imagine your stolen phone is suddenly making its way back to you, but it’s a trick designed to steal even more.
Cybersecurity experts recently uncovered a sneaky operation called AnonyMousKIT. This service helps thieves get past Apple's security features, specifically something called Activation Lock. Activation Lock is a safety net Apple provides that basically turns a stolen iPhone into a brick if someone tries to use it without the original owner's Apple ID and password. It’s like having a car alarm that not only blares loudly but also locks the engine so a thief can’t drive away, even if they manage to get inside.
Here's how AnonyMousKIT works: After someone steals an Apple device, the thieves use this platform to call the victim. These aren't regular human calls; they use rented artificial intelligence [AI] voices that sound incredibly real. The AI voice pretends to be Apple Support, claiming they've found the stolen device and need a few details to return it. What they're actually after is your device passcode (the number you use to unlock your phone) and any two-factor authentication [2FA] codes. Two-factor authentication is an extra layer of security, like when you log into an app and it sends a code to your phone to confirm it’s really you. Giving these codes to the AI voice lets the thieves bypass Apple’s security completely.
Why does this matter? Well, once they have your passcode and 2FA codes, they can unlock your device, remove the Activation Lock, and sell your stolen iPhone as if it were brand new. This makes it much easier for stolen devices to re-enter the market, which sadly encourages more theft. It also means that even with Apple’s strong security features, a social engineering trick – essentially, tricking people into giving up information – can make those features useless.
This incident highlights a growing trend where AI tools, initially developed for helpful purposes, are being repurposed by cybercriminals to make their scams more convincing and scalable. We've seen similar patterns with AI-generated text for phishing emails, but AI voice agents add a powerful new dimension to phone scams. It's a reminder that even the most advanced tech defenses can be undermined by human trust.
What should you do? If you ever lose an Apple device and get a call claiming to be Apple Support offering to return it, be extremely cautious. Apple will never ask for your device passcode or 2FA codes over the phone. If you receive such a call, hang up immediately and contact Apple Support directly through their official website or a trusted phone number you know to be theirs.
Always remember, legitimate support services will never ask for your passcodes or security codes.