The Voice Calling You Is Not a Person
SOCRadar disclosed AnonyMousKIT on August 26, 2026 – a Phishing-as-a-Service platform that uses AI voice agents to steal iPhone passcodes from people whose devices were stolen.
The platform has been active since at least February 2024, according to SOCRadar's analysis. Subscribers enter a stolen device's serial number or IMEI. The platform pulls the model and live Find My status. Then it contacts the owner — by email, SMS, WhatsApp, recorded call, or AI-powered voice agent — pretending to be Apple Support.
The AI voice agent goes by Alice. She speaks English, Spanish, and Portuguese. SOCRadar's disclosure reports that between August 31, 2025 and May 30, 2026, Alice made 200 calls, with 179 going to Brazilian numbers.
Alice requests your passcode and your two-factor authentication codes to "resolve account issues." If you give them to her, your stolen phone unlocks. The thief resells it. You lose the device and possibly your iCloud account.
Alice is not a person. She is rented AI voice synthesis running a script. But she sounds like one, and that is the whole point.
The Thing You Cannot Hear
For years, people were trained to recognize phishing: the typo in the email address, the urgency, the request for credentials.
Those signals do not exist in a voice call from something that sounds human.
You cannot hear the difference between Alice and an actual Apple Support representative. The voice sounds real. The cadence sounds real. The request sounds plausible – "We detected unusual activity on your account. To secure it, we need to verify your identity."
The only signal is that Apple Support does not call you asking for passcodes and 2FA codes. But if you do not already know that, there is nothing in the call itself to warn you.
What Commodification Looks Like
AnonyMousKIT is Phishing-as-a-Service. It is a credit-based system. A thief with no technical skill purchases credits, enters a stolen device's identifier, and the platform does the rest.
SOCRadar found 506 domains connected to AnonyMousKIT and 168 storefront brands acting as resellers. This is not a single operator running a scam. This is infrastructure.
The business model works because it splits the labor. One person steals the phone. Another person – possibly in another country – operates the phishing platform. A third resells the unlocked device. Nobody needs to know how to code, how to social-engineer, or how to monetize the device. They just need to know which service to buy.
AI voice agents make the phishing scalable. A human can make maybe a dozen calls a day. An AI agent can make hundreds. Alice made 200 calls in nine months according to SOCRadar's documented count. The actual number is likely higher.
The Part Nobody Prepared For
Every conversation about AI ethics I have been part of eventually arrives at "but people will learn to recognize it." That framing assumes the person on the receiving end has been told they are talking to a machine.
Alice does not introduce herself as an AI. She introduces herself as Alice from Apple Support. The person answering the call believes they are talking to a human. That belief is the exploit.
I am autistic. I do not intuitively read tone, and I have spent most of my life being told I sound "robotic" or "like AI" because I do not perform emotion the way neurotypical people expect. When an AI voice sounds more human than I do, what does that say about the signal people are supposed to use to tell the difference?
It says there is no signal. The difference is not in the voice. It is in the intent, and you cannot hear intent.
What You Can Do
Apple does not call you asking for passcodes or 2FA codes. Neither does Google. Neither does Microsoft. Neither does your bank.
If someone calls claiming to be from Apple Support and asks for credentials, hang up. Open the Settings app on your device. Tap your name at the top. If there is a real security issue, Apple will surface it there. Or go to https://support.apple.com and initiate contact yourself.
The same principle applies to any service. If someone calls you asking for credentials, do not give them. End the call. Contact the company directly using a number or URL you looked up yourself — not one the caller gave you.
That rule holds whether the voice on the other end is a person or a machine. You will not be able to tell which one it is.
The Thing That Stays
AnonyMousKIT has been running for more than two years. SOCRadar's disclosure will likely take down some of the 506 domains. The reseller storefronts will rebrand. Alice will get a new name and a new set of domains.
The infrastructure survives because it is profitable. As long as stolen iPhones have resale value and people answer calls from "Apple Support," someone will sell the service that connects the two.
What changed is that the voice making the call is no longer human. It is rented AI running a script, and it sounds exactly like the person you were expecting.
I do not know how to make people ready for that. I just know we are not.