CyberWire Daily - An apple a day, a phish away. [Research Saturday]

Episode Date: September 26, 2026

Today we are joined by Ensar Seker, VP of Research and CISO at SOCRadar, discussing their work on "Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain." An investigation into AnonyMousKIT reveals an AI-powered Phishing-as-a-Service platform designed to steal Apple credentials and disable Activation Lock on stolen devices. The platform uses email, SMS, WhatsApp, and AI-driven voice calls to impersonate Apple Support, with researchers uncovering a broader ecosystem spanning 506 domains, 168 storefront brands, and 30 backend installations. Despite its sophisticated social-engineering capabilities, basic coding flaws exposed extensive operational logs and revealed the shared infrastructure, developer activity, and reseller network behind the criminal operation. The research and executive brief can be found here: ⁠Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyberwire Network, powered by N2K. Standard Active Directory Migration Tools don't move AES keys. They move NTLM hashes. That means when you cut over, your applications fail silently. In my recent conversation with Sempros' Mike Masquale, I asked him why standard migration tools miss these accounts and how identity teams can fix them before cutover day. Listen to our full conversation now at explore.thecyberwire.com slash Semperus. Hey, everybody, Dave here. I want to let you know about a special gathering hosted by Zimperium at the Spy Museum in Washington, D.C.

This invitation-only event will bring together federal cybersecurity and technology leaders to discuss some of the most pressing challenges facing government today, including mobile security, mission resilience, and the overall. evolving threat landscape. I'm always grateful for opportunities to spend time with smart people doing important work, and I'm excited to be part of these conversations. I hope to see some familiar faces there. If you're interested in attending, you can request an invitation. You'll find more information in our show notes. Our thanks to Zimperium for sponsoring this event. We'll see you there. Hello everyone, and welcome to the CyberWire's Research Saturday. I'm Dave

Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us. So we were monitoring in the cybercrime ecosystem and started seeing infrastructure, an activity associated with the enormous kit that looked different from a traditional fishing kit. So as we investigated further, it became clear that this was not simply a collection of fishing templates, it was operating much more like fishing as a service supply chain. That's Ensar SECAR, VP of Research and SISO at SOC radar. The research we're discussing today is titled Exposing Anonymous Kit, AI-powered FAS supply chain. So what made it particularly interesting

was the role of AI in automation. And based on this is my experience, maybe some people won't agree with me. But to be honest with you, threats actors using AI and automation much better than us. When I say us, I mean the people in the defense support. So the platform was lowering the technical barrier for attackers by helping them generate convincing fishing content, customize campaigns, and personalize attack much faster than they could with traditional kids. And again, from our perspective, at least from my perspective, the important story was not just one fishing service, it was what autonomous kits, enormous kit representing more broadly. It is fishing is becoming increasingly industrialized, and attackers can essentially consume

capabilities as service, combined them with automation and AI, and launch sophisticated campaigns without necessarily having sophisticated technical skills themselves. And that shift in the attacker ecosystem is what made us believe this was an importance enough to investigate in depth and publish. I want to get into the infrastructure here, but before we do, I'm curious, what problem is anonymous kit solving for criminals? Why has Apple's activation law created a market for this kind of service?

So the core problem the anonymous kit is solving for criminals is monetization. It is one of them, at least. So when an iPhone, iPad or other Apple device is stolen, activation lock can make the device extremely difficult to resell as a fully functional product. So even if the thief wipes the device, it can remain tied to the legitimate owner's Apple account. So the criminal may be left with something that is worth significantly less than an outlocked device. And that creates a financial incentive to obtain the onus credential and remove the lock.

And other things may be anonymous kit essentially helps or personalize the process. Instead of requiring a criminal to build fishing infrastructure, create convincing Apple 10 pages or manage hosting and understand the social engineering workflow. The service packages much of the capability for them. So basically, you don't have to know anything about coding. You don't have to know anything about fishing. basically you can just use the service. So the stolen device becomes the starting point,

but the real objective is often the owner's Apple credentials. So if the attacker can trick the victim into providing those credentials, they may be able to remove the device from the victim's second. And dramatically increase it as a resale value. And that's why activation lock has created the secondary criminal market. The security control is doing exactly what is designed to do, reducing the value of stealing device, but the criminals respond by trying to attack the human being instead of the technical control.

And that's a really important point here. Anonymous kit is not defeating Apple's cryptography or technically bypassing activation law. It is helping criminal socially engineering the legitimate owner into giving them what they need to get around that protection. Well, let's go through that together, a typical victim journey. So it starts off with a phone being stolen. What happens next? Yes. So once the device is stolen, as I mentioned, since there's a connected to the legend

donors, it is very hard to sell with the price they wanted. So typically, attacker first guessed the physical possession of the stolen iPhone. But because of activation lock, they cannot simply reset it and use or resell it normally. So the next step is usually to identify the owner to be to get around that. And create a believable reason for that person to interact with a phishing message. So a victim may receive a text message, email or other notification claiming that their lost iPhone has been found, located, or is waiting to be recovered. So that message then directs the victim to a fake Apple page designed to look legitimate. and the victim is asking to sign into their Apple credentials,

often because they believe they are tracking the device location or starting a recovery process. Once the credentials are entered, they are captured by the attacker, and depending on the workflow, the attacker may also try to obtain additional authentication information, if needed, of course. And at that point, the criminal chain attempt to remove the stolen device from the victim's Apple account

or otherwise defeat the account level protection that was preventing the resale. So the journey is very important. That's why it was a very good question, Dave. Thank you so much for asking that, because the technical security is still there. The attackers is essentially going around by manipulating the owner. The stolen phone creates the opportunity,

but the fishing and socially entering are what turned that stolen device into something criminal can actually monetize. You know, one of the things that caught my eyes, I was reading through the research, I suppose it's a sign of where we are today is that there was an AI voice component. There were AI calls from Apple support that were AI generated. Tell us about that. They're using AI voices and deep fake as well. Those are one of the biggest challenges for industry today, I believe.

And yes, I think, again, just the most important part of the support. because it shows how fishing is evolving beyond email and SMS. So basically the attacker can use AI-generated voice calls that impersonate Apple support and make the entire social engineering squadrons feel much more legitimate. So image that you have already lost your phone and you are anxious about recovering it and then receive a convincing call that appears to be from Apple support telling you that your device has been located or that you need to verify information. So that voice interaction adds another layer of credibility.

For many victims, a phone call feels more trustworthy than a text message, especially when the voice sounds professional and the script is tailored to the situation. And what AI changes here is the scalability. So traditionally, voice fishing required a real person to make those calls and speak the language, follow a script, and handle the interaction with AI genera. voice and criminals can automate much more of that process, operate across different languages and potentially target many victims at the same time. And so this is not just about creating a more convincing fishing page. It is about orchestrating multiple channels together, SMS, fake Apple pages, and now AI-generated voice.

And it makes the attack feel like coordinated customer support experience rather than a traditional fishing attack. And from defensive perspective, that is the bigger concern because we can no longer tell users simply to look for bad grammar or suspicious emails. They basically solve all this issues with this AI-supported

voice messages, voice calls. So the social engineering is becoming much more polished, personalized, and increasingly automated. You know, there's an interesting contrast here. The platform uses conversational AI and some sophisticated automation, but your investigation was helped by some very basic coding mistakes.

What did the developers get wrong here? Yeah, usually this is very interesting for me as well. I'm in dark web every day. You see some high-scale operations from the chat actors, but somehow they make some small mistakes. That contrasts one of the most interesting parts of the investigation. So on the front end, you have fairly sophisticated criminal service using conversational AI, automated fishing workflows, multiple communication channels and resalear ecosystem.

But underneath that, the developers made some very basic application security mistakes. So in our case, those weaknesses allow us to access the very large amount of operational logging, roughly 120,000 lines of logs, I believe. So that gives us visibility into how the same. service was actually being used, and including operating operator activity, infrastructure, WhatsApp accounts, and the other parts of the ecosystem. So the irony is that they were building a platform designed to export other people's security failures while that introducing their own. And this is something we see quite often in the cyber crime infrastructure, criminal developers

tend to optimize for speed, scale, and monetization, and secure software developers. is not necessarily their priority. So they may build sophisticated summation on the top of poorly protected API, expose debugging information, mishandle authentication or authorization, or leave excessive operational data accessible. I remember a couple other cases like 40 bleat.

Recently we also discovered some vulnerabilities, threat actors servers. So by using those vulnerabilities, we were able to access their server and collect information. And that was the case, US DOD, that was a threat actor. And they also, David, his main target was United States military, governments, and US companies. They directly targeted cross-strike and SOCreda as well.

So while we are sharing information with FBI, while I was investigating the logs, at one moment, I realized that threat actor, USDOD, and he was also using the USDOD logo as well. And yeah, it was interesting, the irony. And the most attacks, most targets by him is the USD itself. And at one moment, Dave, I realized that person didn't use Kilsvich, and his VPN dropped, and he really appeared for 10 seconds. Yeah, so from that IP address, we were able to locate him. And FBI did operation with the Brazilian federal police.

I believe. So they arrested him. Of course, not just with the IPI, just they had to confirm it. Croft strike especially provided so many good information to the FBI. So with this operation, they were able to arrest that person. So John just one small mistake let him to arrest it in Brazil. Wow. I mean, I was expecting like APC group from Russia or China since he constantly targeted

the government, US government and military. And he was just a lonely hacker. So that was surprising too. We'll be right back. And now a word from our sponsor, SpectreOps. Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments

as one connected graph, identify the choke points that matter most, and bring trusted attack path intelligence into a, AI workflows with Bloodhound Hunter. See how SpectorOps helps teams secure the AI-driven identity era at SpectorOps.io. Yes, you can have an enterprise network that's secure and reliable and high performance. And no, you don't need to choose the best two out of three. With Meter, you can get the end-to-end network built from the ground up, fast to deploy, and easy to manage. That's because meter is software-led for easy installation, maintenance and control for

everything running on your enterprise network. Hardware, firmware, and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why meter gives you comprehensive visibility into wired and wireless routing, switching, firewalls, DNS security, and VPNs. You'll really know that. You'll really know, what's running on your network down to the most granular client level. Step off the hardware box upgrade treadmill and switch to Meter for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at meter.com slash cyberwire.

That's M-E-T-E-R dot com slash cyberwire. You know, the platform advertises having technical unlocking tools, but your research suggests that those tools don't work nearly as well as they advertise them. Yeah, exactly. What were the tools really doing there if they're not effective? Is it just an extra thing that they can list on the capabilities? You mean the tools used by the chat actors? Yeah.

Yeah. So we also investigated those tools as well. And there, to be honest, again, this is one way to think about it. So for the transactors, using the service AI voice becomes another capability. They can add to the attack law. And the tools, some of them are very useful and some of them are not. I didn't get a chance to analyze those tools, to be honest. But I know recently, especially with the wipe coding, they can develop many tools where, again, you don't have to know anything about

coding, right? I just tell the prompt to the AI and the AI can provide me the output as a software. Of course, it is not just like it is created by professional programmer it is going to, that's why they

have those flows, right? Most probably those tools maybe created by the wipe calls or AI and that's why security is not that in high level for those codes. But at the end of today, again, they're using just for the operation and they never used it again, most probably.

That's why we see those tools. Again, the chat hackers are using AI much better than us. I know this because, for example, we monitor many channels and telegrams, hacker forums. But when we use automation systems or AI, they can easily stack it and they just plug it. That's why I know they use it very effectively. But for operations, it is just turning that data to money as soon as possible. So that's what I don't think the tools they're using is not that sophisticated, especially if it is a ransomware threat.

For APTs, of course, they are using very sophisticated and very high-level tools. But in this case, no, they just want to get the money as soon as possible and get the data for that. And that was it. What did the research reveal about the scale of this operator community? Do you suppose we're looking at a handful of specialists, or a service that lowers the barrier for relatively unsophisticated criminals. Yeah, this is also a great question.

So what the research show, our investigation showed, is that this is much closer to the second scenario. It is not just a small group of highly specialized operators. Anonymous kit appears to be designed to lower the barrier to entry. There's service packages to gather capabilities that would, otherwise requires several different skill sets. For example, fishing infrastructure, page development, hosting, social engineering, credential collection, what else, messaging, and in some cases, AI-assisted interaction.

So that means relatively unsophisticated criminal does not need to understand how every component works. And that's why today we have ransomware as a service 3.0, right? Because your estimate as a service, it just used to be like, at this, like, I always use this analogy. For example, you know how to drive a car, but you don't know how to maintain the car, right? You have a driver license. And basically, you go to the Uber and you tell them, like, I have a driver license. I know how to drive a car.

But I don't want to own a car. I don't want to maintain this car. I don't want to pay taxes or whatever. So just give me the car. You're going to make some money and they're going to share it. And Uber says, okay, here it is. This is your car. And with the ransomware 3.0, what you do is you say, I don't even know how to drive a car.

I don't know how to drive a license, but I want to make some money. Is it possible? Yes. For example, maybe you're familiar. Tesla, they are doing this at the Texas right now. So you can call Tesla like Uber, but it comes with the engineer. The engineer basically doesn't draw the car or drive the car. He just sit on the passenger side and he just control everything is okay.

So that's the pilots they're trying if it is work or not. So basically that engineer makes money just sitting in there, right? Just checking, yeah, it doesn't have a. So Ransom Rail as a service, 3.0 like that. You don't even have a driver rises. You don't even know how to drive a car, but you want to make some money. And they say, okay, you're going to handle everything. Just you need to provide this initial access.

So basically, in this case, they provide this information, fishing infrastructure, with the many specialization. And that means relatively unsophisticated criminal does not need to understand again how every component works. And that's one of the larger security implications. When cybercrime becomes protractize, so the number of people capable of conducting effective attacks increasing significantly. So you're essentially separating the person who develops the capability from the person who uses it.

And so instead of asking how many highly skilled fishing developers are there, the more important question becomes how many criminals can gain access to these services. And that's a much larger population. So the operator ecosystem we observe also had characteristics. So you would expect from a major service model including like different users, supporting infrastructure, communication channels and reseller type relationship. So that tells us this is not simply one attacker running one fishing campaign. it's an ecosystem designed to support multiple operators and scale their activity.

And in my view, the commoditization is ultimately more concerning than any single technical feature of the anonymous kid. So what are your recommendations? For organizations, how should they respond when an employee reports a stolen iPhone, let's say? So the first thing is a threat stolen corporate iPhone as both a physical security incident and potential identity security incident as well. So the organizations should immediately use their mobile device management capabilities

to lock or wipe the device where appropriate, revoked active sessions, review the employees' account activity, and make sure the device remains associated with the organization's management controls. But there is also human side to the response. So the employee should be warned that they may receive very convincing follow-up messages or phone calls claiming that the device has been found or that Apple support needs to them, verify their account. So that is where attacks like anonymous kid become relevant.

The attacker already has important contacts. They know the person recently lost the phone. And that makes the social engineering message much more believable. And so employees should be told very clearly not to enter Apple credentials through the links sent by SMS or email, not to provide verification codes over the phone and not to remove the device from their Apple accounts simply because someone claiming to their support asks them to do so. And for organizations, I would also recommend monitoring for suspicious authentication attempts, credential fishing domains and unusual account recovery activity following a device theft.

And finally, they should build this scenario into their incident response playbooks. Is it a response place a very important role when it comes to the managed incident. So reporting a stolen phone should automatically trigger not only device containment, but also identity monitoring and a targeted warning to the employee about the social engineering activity that may follow. And the key point is that the incident does not necessarily end when the phone disappears. In many cases, that is when the second phase of attack begins. Our thanks to Ensar SECR from SAC radar for joining us. The research is titled Exposing Anonymous Kit, AI powered fast supply chain. We'll have a link in the show notes.

And that's Research Saturday, brought to you by N2K Cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at n2K.com. This episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester.

Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.