AnonyMousKIT phishing kit
AnonyMousKIT is a phishing service aimed at owners of lost or stolen Apple devices. We have matched its shared operator-console code on 28 sites since 26 August.
AnonyMousKIT in numbers
Since 26 August, the first AnonyMousKIT match in our records, counted on 12 October 2026. How we count.
| Sites with shared AnonyMousKIT console code | 28 |
|---|---|
| Sites with a match in the last 30 days | 15 |
| New sites in September | 16 |
| Sites captured since 25 September | 4 |
A stolen device supplies the story
SOCRadar researchers documented AnonyMousKIT as a service for people trying to unlock lost or stolen Apple devices. The operator enters the device and owner details, then contacts the owner by email, text message, WhatsApp or a voice call. The message says the device has been found and directs the owner to a fake Find My page.
The visitor is asked for the device passcode, Apple Account credentials and a current two-factor code in sequence. Those values can give the operator what is needed to remove the device from its owner's account. Anti-bot checks sit in front of some copies so automated visits never reach the forms.
The Ohey match is inside the operator console
Our direct family match is a JavaScript file used by the operator side of the service. The same file appeared byte-for-byte across separate Apple device panel domains and remained unchanged throughout our captured copies.
The script creates server-side data tables for records stored by the panel. It keeps selected record identifiers checked while the operator moves between result pages, restores them when a table redraws and serializes the complete selection for a bulk action. The available actions disable, enable or delete the selected records through the panel API.
That shared console code connects the deployments in our dataset. The site total on this page counts panels carrying the console script; it does not count every fake Find My page created through those panels.
What we see
| Month | New sites |
|---|---|
| September | 16 |
| October so far | 3 |
We captured 4 AnonyMousKIT sites since 25 September. 0 of them were running WordPress.
Finding the console code
On a suspected panel, preserve legacy.js and search for a selection array that survives server-side table pagination and redraws. Follow the handlers that gather checked record identifiers, restore those checks and send an id list to bulk disable, enable and delete endpoints. On the visitor side, preserve the complete reported path and look for the ordered passcode, Apple Account and two-factor-code forms behind the anti-bot gate.