Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain

The SOCRadar Threat Research Unit (STRU) has conducted an “inside-out” analysis of AnonyMousKIT, an AI-powered Phishing-as-a-Service (PhaaS) ecosystem specifically engineered to disable Apple’s Activation Lock on stolen devices. Operating as a credit-metered platform, AnonyMousKIT automates credential harvesting through a sophisticated multi-channel pipeline – integrating email, SMS, and WhatsApp with advanced conversational AI agents to conduct AI-driven Automated Social Engineering (voice phishing) calls.

By leveraging a critical flaw – the use of bare relative paths – the investigation unraveled a reseller supply chain of 506 domains and 168 storefront brands active since early 2024. Despite leveraging advanced AI to mimic “Apple Support,” basic coding errors exposed production logs and operator rosters.

This analysis breaks down AnonyMousKIT’s attack lifecycle, threat actor hierarchy, and institutional risks. Beyond device monetization, harvesting Apple IDs threatens corporate security by exposing iCloud backups and Keychain credentials.

Key Findings

AnonyMousKIT is a live, credit-metered AI-Powered Phishing-as-a-Service (PhaaS) platform specifically tailored to the stolen Apple device market. It enables criminals to automate the pursuit of victim credentials to unlock stolen hardware. Key findings include:

• Device-Led Targeting: Lures use internal Apple model identifiers (e.g., iPhone16,2) and real-time Find My statuses obtained directly from stolen devices. Across the full family, 5,031 targeted devices were Online and 1,035 were Locked, of 6,092 phishing emails.
• Multi-Channel Persistence: Victim profiles automatically drive campaigns across email, SMS, WhatsApp, recorded audio, and AI calls.
• Conversational AI Social Engineering: Renting commercial AI voice agents, the platform dynamically inserts victim details into a pretext (“Alice from Apple Support” investigating an impounded stolen phone). Over 200 calls (90% to Brazil) cost just $19.24 total.
• Deceptive Tooling as Bait: The panel offers four free unlock tools (including checkm8-based jailbreaks like palera1n) to attract thieves. Because checkm8 only supports A8–A11 chips and targeted devices were A12 or newer, these binaries serve purely as bait to meter phishing services.
• Trusted-Relay Delivery: 97.7% of delivered emails (589 of 603) relayed through a single free Gmail account disguised as Apple no-reply support.
• A Reseller Ecosystem, Not a Product: Shared panel code links 506 domains and 168 storefront brands active since February 2024, proving these brands are resellers of a single codebase.
• An Operator Base in the Low Hundreds: Exposed logs reveal 689 distinct WhatsApp operator accounts across the 30-backend family – against the 173 visible in the email data – plus two administrator accounts and twenty operator handles leaked through a UI label.
• One Developer, Many Storefronts: A single operator appears in 12 of the 24 SMTP backends with an identical test pattern: precisely 26 entries per installation. Three brands launched on the same second (10 April 2026) using the same Gmail relay accounts. They are not three customers; they are one buyer operating three storefronts.
• Still Trading: Logs confirm active operations through August 2026, with AnonyMousKIT’s own log now standing at 691 email records and 120 WhatsApp operators.
• Operational Failure: Coding flaws using bare relative paths exposed 120,242 lines of AnonyMousKIT’s email logs alone (166,052 lines of WhatsApp logs), and the equivalent logs of every other deployment.

The Evolution of iPhone Theft

Apple’s Activation Lock feature, introduced in iOS 7, ties hardware directly to a specific Apple ID, rendering stolen devices essentially “bricked” and limited to low-value parts unless unlocked. This has shifted phone theft into a two-stage process requiring both physical theft and the acquisition of the victim’s credentials.

This requirement created a lucrative cybercrime service industry where non-technical thieves pay for credential harvesting to unlock and resell high-value hardware. AnonyMousKIT represents the latest evolution in this ecosystem, providing a specialized, pay-per-action phishing platform designed to monetize stolen devices.

Internal Mechanics of AnonyMousKIT

While AnonyMousKIT uses typical pay-per-action models and spoofing tactics, our investigation offers a rare inside-out analysis based on:

• Backend source code and four months of production logs.
• The operator console and victim-capture pages.
• Vishing account artifacts, including AI prompts and transcripts.
• Four additional same-family backends for cross-brand comparison.

This access reveals how victim records transfer across channels and exposes the economics of modern iPhone theft.

AnonyMousKIT Campaign Timeline

• February 2024: The panel codebase is first observed in the wild. A URLScan capture of the shared admin library (legacy.js) establishes the kit family as at least two and a half years old, indicating the platform uses a rebranded instance of a circulating kit.
• March 2025: The AI personas are constructed. English (“AiVoice”), Spanish, and Brazilian Portuguese personas are configured, all sharing the “Alice from Apple Support” identity.
• July 2025: The UKT backend, the oldest known installation, begins recording WhatsApp module loads. Its log eventually reaches 627,021 lines.
• August 31, 2025: The first recorded AI vishing call is made, marking the beginning of a 200-call record set recovered from the operator’s VAPI.ai account artifacts.
• September 2025: First AnonyMousKIT panel domains are observed, showing open subscriber registration and a focus on Portuguese and Spanish speaking targets.
• October 2025: The ecosystem reaches peak activity, with approximately 400 URLScan captures of the shared panel library recorded in a single month.
• November 2025 – January 2026: The domain fleet undergoes rotation. Six panel domains cycle through the infrastructure, supported by a “Clean Domains” utility exposed in the panel.
• March 14, 2026: The first phishing email appears in the exposed 117,440-line SMTP log.
• April 2026: The backend is re-deployed mid-campaign. Archive timestamps indicate the codebase was repackaged while operations were active.
• April 10, 2026: Three Cluster B brands (i-Blocker, Key Unlock, and KG-KING) launch on the same second with the same Gmail relay accounts and shared operator pool.
• May 30, 2026: The last AI vishing call is recorded; the voice channel goes quiet approximately two months before the email channel.
• July 30, 2026: The final email is logged. A subscriber in South Africa attempts to send phishing lures on a zero credit balance, indicating local subscriber churn or depletion of specific operator credits.
• July 31 – August 4, 2026: By obtaining the victim-facing kit from i-cloudsd[.]com, STRU confirmed that the panel was active, directly connecting the panel logs to the capture page.
• August 10, 2026: Panel logs record operator activity continuing through the last day of collection. The platform remains live and operational.

Search the Dark Web for traces of your organization’s digital footprint:

The Attack Lifecycle

The process spans seven distinct phases, progressing from the initial possession of a stolen device to its eventual resale.

The AnonyMousKIT Platform

Operating on a pay-per-message model, the platform allows subscribers to input a stolen device’s information once and distribute phishing lures across five distinct channels until successful. Below, we break down each channel alongside the varying levels of recovered evidence available for our analysis.

Channel 1: Email

Email is a key vector for AnonyMousKIT. From March to July 2026, the platform logged 691 send attempts (and 6,092 across all 30 backends). A total of 603 lures reached victims’ inboxes, with remaining attempts blocked by internal rate limits or depleted credits.

The ‘No-Reply’ Deception

The platform relies on a “no-reply” tactic, registering standard Gmail or iCloud accounts like “noreplyapple00000[@]gmail.com” with names like “Apple Support” or “Find My Team”. These appear convincing on small mobile screens. Between March and July 2026, hundreds of these lures reached inboxes, demonstrating that simple human deception effectively bypasses security.

Email clients show custom “From” names instead of addresses. The 22 variations found differed mainly in trailing whitespace, showing the operator manually pasted names from notes rather than a pre-set list.

• Key “From” display names included Apple (1,246 sends), “Apple “ (536), Find My (411), “FindMy “ (297), “Find My “ (232), FindMy (198), Apple Support (93), and “Apple Assistance “ (50).
• Fifteen emails used default “User <noreplyapple00000[@]gmail[.]com>”.
• Manual setup errors exposed an operator’s personal Gmail in three emails.
• The campaign used 35 lure domains, 51 subject lines, and 13 HTML templates.
• Top subjects were “Your device has been found” (308) and “Alert” (157).
• Most lures were in English (662), followed by Spanish (25) and French (4).
• 678 of 691 lures included location tokens for cities like Johannesburg, Abuja, Buenos Aires, Maputo, and Mumbai.
• Targeted devices comprised 630 Online and 61 Locked.

Channel 2: SMS

Without retrieved operational logs for the SMS channel, its mechanics were reconstructed from the panel and source code. This architecture reveals a commercialized marketplace rather than a basic transmission interface.

• Sender ID Classification: Managed via u_senders_status: owned (free for author), shared (paid, restricted by CSV allow-lists), and public (paid, open).
• Routing Mechanism: Triggers via send_sms() → get_sms_server_api() → /sms_api_pro/api_user.php on the relay host.
• Status Classification: Uses a bilingual parser for Spanish gateway returns: encolado, procesando, pendiente, entregado, exitoso, créditos insuficientes, saldo insuficiente, número inválido, formato inválido, servicio no disponible, rechazado, and bloqueado.
• Target Validation: Executes check_phone_number() via Messente API before dispatching lures.
• Telemetry Recording: Logs to logs/send_sms_apix.log and logs/sms_api.log (unrecovered).

Spanish status terms indicate a Spanish-speaking supply chain for upstream SMS gateways, while the sender ID marketplace commoditizes spoofed identities via compromised A2P aggregator accounts.

SMS is fully integrated into the voice protocol; conversational AI scripts prompt agents to check for text receipt and pause 15 seconds to resend if unreceived.

Channel 3: WhatsApp

The WhatsApp channel operates via two mechanisms: backend dispatching of templated messages via client-specific Business API instances (tracking delivery and sending Telegram alerts) and a dedicated persona managed through the operator’s AI account, enabling full underlying prompt recovery.

Channel 4: Voice, Recorded Template

This economical vector utilizes Twilio to initiate calls, triggering a webhook that plays pre-recorded audio and gathers DTMF inputs for 4- or 6-digit passcodes. Administrators avoid usage fees and can sustain calls for up to 12 hours.

Channel 5: Voice, AI Agent

Priced at 2 credits, this channel is the best-documented vector after email. Artifacts from the operator’s VAPI.ai account revealed 5 configured personas with complete system prompts, 200 call logs, and 55 interaction transcripts.

The Persona Library

Instead of building agents, subscribers use the control panel to query the platform’s VAPI account (GET api.vapi.ai/assistant) and select personas from a dropdown menu.

All three voice options share the same translated persona: “Alice Dias, Apple Support”:

The Script

The system prompt demonstrates structured social engineering: it claims to assist with a “lost device,” confirms ownership, and extracts the 4- or 6-digit passcode via dictation. It then presents a cover story naming the victim, model, and a fake in-store recovery case. Finally, it confirms SMS link delivery (resending if needed), guides unlock code entry, and terminates the call via the endCall tool upon verification.

What a real call sounds like:

Software extracted and verified the passcode for roughly ten cents before the automated agent guided the victim to the phishing link. Although transcriber errors later disrupted call quality, the threat actors successfully secured the credentials.

Infrastructure Analysis and Mapping

Analysis of apple-login-imaps[.]com extracted its CakePHP backend (ToolsController.php), uncovering AnonyMousKIT – a five-channel phishing framework with automated billing, tracking, and Telegram webhooks.

• The central backend relay domain, anomkit[.]shop, points to the IP address 75.119.135[.]83, which is a German-hosted Contabo VPS. This specific node also hosts associated malicious properties including findsupport[.]live and apple-thailand[.]co, which served the same dashboard configuration five months prior. The co-located domain kanoondekho[.]com shows no connection to Apple branding or phishing. As a benign neighbor on a shared host, it was excluded from defense indicators.
• A legacy.js hash pivot revealed 1,416 URLScan captures over 30 months, connecting the campaign to related unlocking architectures (PRO KIT, Painel-Rescue Unlocker, ULTIMATE KIT V5, AppleChecker).
• URLScan detected the login page across 15 domains on /login between September 2025 and March 2026.
• Front-end panels use Cloudflare for obfuscation. Historical logs show the main internal mail relay, irealm-server[.]co – which defines the platform’s core code naming – is now deactivated.

Lure Domains From the Panel’s Own Records

The panel revealed 15 lure domains (9 previously undocumented, 6 Iberian). Paired singular/plural domains (e.g., find-alert/find-alerts, fmi-dispositivo/fmi-dispositivos) indicate operators acquire them in small batches.

Verified Core.js Dataset: 26 Confirmed Lure Hosts

These lure hosts act as initial victim touchpoints in multi-channel campaigns. Each URL uses tokenized parameters (e.g., /help?TOKEN) mapping directly to backend victim records and device profiles.

• Anti-Bot Gateway & Localization: Client-side scripts (Core.js) filter security scanners and render localized, Apple-branded interface elements.
• Device Tracking Visuals: An interactive map shows the handset’s real-time Find My status and location to establish trust and urgency.
• Credential Sequential Capture: The platform systematically extracts the device’s 4- or 6-digit passcode, Apple ID credentials, and live 2FA codes, exfiltrating all data to the operator panel and Telegram webhooks in real time.

Ecosystem Distribution: Page Title Identification Across 148 Domains

The phishing infrastructure uses dynamic localization. URLScan telemetry detected the German title “Geräte finden – Apple iCloud” alongside the standard English “Find Devices – Apple iCloud”. A pivot analysis revealed 220 scanning instances across 148 lookalike domains active between June 1, 2024, and July 26, 2026.

• South Africa Focus: Fourteen domains use regional suffixes (.za, .co.za, .za.com, .sa.com). Mail logs confirm at least one local paying customer. Subdomains like .sa.com bypass identity verification while establishing localized trust.
• TLD Distribution: The fleet includes 42 .com, 29 .info, 21 .live, and 10 .click domains, plus low-cost options (.support, .website, .app, .site) and single instances of .irish, .icu, .pw, and .team.

Cross-Brand Infrastructure: One Codebase, Thirty Backends

AnonyMousKIT’s log exposure stems from a flaw in its shared codebase: two relative file paths resolve to the web root, allowing unauthenticated HTTP access. Consequently, all deployments inherit this flaw. A scan of 506 kit-family domains identified 41 active backends (30 distinct installations on 42 domains), while the remaining sites are offline or sinkholed:

Log analysis reveals storefronts i-Blocker, Key Unlock, and KG-KING are managed by a single entity, Cluster B. Launched simultaneously on April 10, 2026, using identical Gmail relays and eight shared operator emails, they represent one Threat Actor Cluster rather than separate clients.

• UKT is the earliest installation (July 2025), predating others by eight months. Its WhatsApp log is the largest at 640,439 lines, but zero successful SMTP deliveries indicate full reliance on WhatsApp or an initial email misconfiguration.

The email underc0deapple[@]gmail.com appears in 12 of 24 SMTP backends, each showing a single send_email() call that generates 26 log lines of test content. While it is the first recorded operator in AnonyMousKIT, Cluster B backends record xgodauth[@]gmail.com hitting three installations twelve hours earlier. This timeline suggests underc0deapple[@]gmail.com is the developer/reseller validating post-setup configurations, while xgodauth[@]gmail.com is the Cluster B buyer.

A scan of the 506-domain family identified 41 live backends (30 distinct installations across 42 domains) exposing these logs, while 318 domains are offline/sinkholed and 188 remain live.

Unlockers

In illicit markets, an “unlocker” converts stolen, locked devices into saleable assets. This demand drives the criminal ecosystem and phishing frameworks, with AnonyMousKIT acting as one of several storefronts.

What an Unlocker Actually Sells

When Activation Lock secures a stolen iPhone, bypassing it requires either a technical exploit or the owner’s Apple ID credentials. Since getting passwords relies on social engineering, these platforms target the human element.

Thus, an “unlocker” is an integrated suite rather than a standalone app. It combines device intelligence for hardware profiling, phishing tools for credential harvesting, and a desktop client for post-compromise control. AnonyMousKIT offers all three features, matching the operational flow and layout of its competitors.

What Anonymouskit Ships

Four distinct binaries are hosted on the panel’s Extensions “How to use?” page. Two of these applications are proprietary tools developed by the operator, while the remaining two are duplicated versions of public jailbreak projects.

The unlocker serves as an advertisement to attract device thieves, while metered messaging generates revenue.

Three supporting features share this workflow: Serial Services and Serial History resolve handset serials/IMEIs and log past lookups, Mac Info Reader handles Macs, and Clean Domains manages burned lure domains. The first two likely supply the internal model identifiers and live Find My statuses in campaign records, though their controller was missing from recovered files.

Broader Family Analysis

Analysis of the shared panel library (legacy.js) uncovered 1,416 captures across 506 unique domains and 168 storefront names. Keywords like unlock, kit, panel, FMI, iCloud, IMEI, bypass, or checker appear in 75% of these titles.

These findings independently validate earlier data: exactly 15 domains feature the AnonyMousKIT title, matching the fifteen domains previously identified via URLScan captures. This complete alignment confirms identical results across both collection methods.

Threat Actor Profiling

Unlike traditional centralized threat groups, AnonyMousKIT operates as a decentralized enterprise structured across four specialized tiers within a cybercrime supply chain.

The Developer

The commercial seller account is distinct from the developer, whose identity emerged via operational data rather than Telegram. underc0deapple[@]gmail.com appears as an operator across 12 of 24 SMTP backends, leaving a uniform test pattern of a single validation send (26 log lines) per setup. It is the initial operator logged in AnonyMousKIT. In the three Cluster B backends, it appears roughly 12 hours after xgodauth[@]gmail.com, indicating the buyer assumed panel control right after the developer’s installation pass.

The Seller

This section profiles the seller responsible for distributing the platform. The initial lead originated from SOCRadar’s Threat Hunting – a module which provides deep investigative pivoting across global threat telemetry to uncover hidden infrastructure and actor links. This capability allowed us to identify the brand name inside a marketplace channel and successfully trace it back to the underlying seller account.

Searching for “AnonyMousKIT” on Telegram uncovered promotional ads exposing the threat actor’s identity. These ads appeared in “iCloud Clean Slow”, a third-party marketplace for trading stolen, unlocked (“clean”) phones. The seller advertises directly in this existing buyer hub rather than their own channel. Although the connected domain names are regularly rotated every few months, these primary handles act as the campaign’s enduring infrastructure.

The Resellers (Storefront Owners)

A third role exists between the developer and operators: buyers who license backends to run storefront brands. Logs expose three distinct buyer identities (detailed in Cross-Brand Infrastructure).

• Buyer A: AnonyMousKIT (anomkit[.]shop) has 27 paying email operators from 120 WhatsApp users, with no separate buyer identity found.
• Buyer B: Cluster B operates three storefronts (i-Blocker, Key Unlock, KG-KING/i-Realm) launched simultaneously on 10 April 2026, sharing first operator [email protected] and 15 unique operators.
• Buyer C: UKT runs the oldest installation (July 2025) and operates strictly on WhatsApp with 87 active operators after its SMTP relay failed.

The Customers (Subscribers)

An operational flaw in the panel’s WhatsApp activity log exposed the platform’s customer base by recording operator account IDs upon page load.

Over six months, the log tracked 120 active operators out of 1,721 sequential, auto-incremented account IDs. This reveals that 93.0% of provisioned accounts were inactive – representing abandoned, unfunded, or test sign-ups.

Additionally, operators leaked their own handles, which were displayed on shared WhatsApp API interfaces and logged by the server.

Assessment

The findings reveal an interconnected supply chain rather than an isolated threat group. Scanning 506 domains expanded the scope to 30 backend installations linked by a common developer, shared codebase, and exposed logs. Operations split into distinct entities: a single developer sells the software; one buyer leads AnonyMousKIT with 27 sending operators; another oversees three Cluster B storefronts (Key Unlock, KG-KING, i-Blocker) with 15 operators; and a third directs an older WhatsApp-only installation (UKT) with 87 operators. Unassigned IDs up to 1,721 suggest additional unmapped storefronts.

The seller’s Telegram activity – status updates, pricing, and collection notices – reflects routine software vendor operations. Rather than requiring a sophisticated threat actor, the setup relies on a developer installing CakePHP, configuring SMTP relays, and processing subscriptions, with the codebase handling execution.

Victimology & Targeting

This segment evaluates targets – owners of stolen Apple devices contacted during recovery efforts – separately from the malicious subscriber operators. Analysis compares AnonyMousKIT’s data against the 30-backend family (6,092 records) to surface broader campaign patterns.

Target Selection Criteria

Targeting focuses on recent victims of Apple device loss or theft. Contacting them during active searches increases social engineering success by exploiting real circumstances and accurate hardware data.

Victim Mail Providers

Consumer webmail dominates in both datasets, but the two diverge sharply on how often a lure lands in an institutional inbox.

Institutional Exposure

For AnonyMousKIT, 9.3% of traffic (64 sends across 24 organizations) targeted non-consumer domains. These included 27 to South African government domains (*.gov.za) and three to a local university. Targets were chosen due to stolen devices rather than government roles, but compromised Apple IDs still risk exposing iCloud backups, Keychain credentials, and work emails.

Across all 30 backends, institutional targeting was proportionally smaller yet broader: 165 sends across 73 organizations globally, including another government domain and four additional education domains.

Geographical Analysis

Independent datasets show clear regional variations in the platform’s footprint.

These findings reveal a global customer base running localized campaigns – such as the Brazilian voice operation, South African AnonyMousKIT subscribers, and an Indonesian cluster – sharing infrastructure rather than operating as a single unified threat actor.

Email – Family-wide, by “Found Near” Location (30 Backends, 6,092 Sends)

AI voice – By Dialled Number

Indicators of Compromise (IOCs)

Large IP and domain lists are condensed to avoid clutter; all hashes, identities, senders, and strings are fully detailed. Complete lists are available on SOCRadar.

MITRE ATT&CK Mapping

Recommendations & Mitigation

To defend against the industrial-scale phishing ecosystem exemplified by AnonyMousKIT, organizations must pivot from reactive IOC blocking to a layered, multi-dimensional defense-in-depth strategy. The following professional recommendations are categorized by technical, procedural, and reactive controls.

Technical Detection & Network Defense

• NRD Filtering & Predictive Blocking: Implement automated DNS-level filtering for Newly Registered Domains (NRDs). Our analysis shows the AnonyMousKIT family relies on high-velocity domain rotation. Blocking domains registered within the last 30 days significantly disrupts the delivery of fresh lures before they can be categorized by standard reputation engines.
• URL Pattern Matching: Configure Security Gateways (SWG/SEG) to inspect and flag the specific tokenized URL structure identified in this campaign (e.g., /help?TOKEN=). Detection logic should specifically target Apple-themed strings combined with low-cost TLDs like .info, .live, and .click.
• Email Authentication Hardening: While strict DMARC “reject” policies are essential for domain reputation, they do not prevent the abuse of legitimate, consumer-grade SMTP relays. Therefore, defenses must be augmented with behavioral analysis systems tuned to detect “lookalike” display names (e.g., “Find My” or “Apple Support”) originating from free services like Gmail, which accounted for over 97% of this campaign’s delivery success.

Procedural & Institutional Security

• Enterprise MDM & Lock-Down: Utilize Mobile Device Management (MDM) profiles to restrict “Developer Mode” and prevent the execution of side-loaded binaries or unauthorized jailbreak tools. This neutralizes the platform’s ability to utilize technical “unlockers” even if a device is physically possessed.
• Vishing & Social Engineering Awareness: Current training must evolve to include “AI-Augmented Social Engineering.” Employees should be briefed on the high fidelity of modern AI voice agents. Explicitly communicate that support entities will never call to request a screen passcode or a 2FA code over the phone.

Incident Response & Recovery Strategy

• Tiered Response Protocol: Upon a reported device theft, the IR team must immediately trigger a remote wipe via MDM and initiate a global password reset for the associated Apple ID to invalidate any Keychain-synced corporate credentials before the phishing phase begins.

2FA Audit & Hardware Keys: Transition high-value targets to physical hardware security keys (e.g., YubiKey) for Apple ID authentication. This completely mitigates the risk of “real-time” 2FA interception, which is the ultimate objective of the AnonyMousKIT funnel.

Conclusion

AnonyMousKIT is best understood not as a phishing kit but as a small software business with a criminal customer base. It features credit bundles, published pricing, tiered subscriptions, customer support, status tracking, and infrastructure replacement protocols. While mirroring standard SaaS platforms, its output is strictly criminal: the systematic removal of Apple’s Activation Lock.

Since Apple fixed the silicon-level checkm8 bootrom flaw, technical bypasses are obsolete. Operator telemetry confirms the overwhelming majority of targeted devices use A12 chipsets or newer (5,649 of 6,092); only 4 records target A11-or-older iPhones, alongside 379 Macs, 33 iPads, 17 Watches, and 4 iBridge devices, which cannot be unlocked with the panel’s free jailbreak utilities. With technical exploits ineffective, the platform industrializes social engineering to trick device owners into surrendering credentials.

Its primary innovation is an automated, LLM-driven voice vector. At ~$0.10 per call, the platform initiates dynamic vishing across three languages using structured pretexts synced with email and SMS lure data, removing the need for fluent human callers.

Despite fragmented storefront branding, the underlying infrastructure is highly centralized. A panel hash pivot revealed 506 domains across 168 storefronts. A full scan of the 506-domain family exposed 41 additional live backends – 30 distinct installations across 42 domains – sharing the same core codebase, developer test signatures, and operational security vulnerabilities, proving the ecosystem relies on a common shared backend.

The platform was still running on the last day of our analysis. SOCRadar continues to track it, its sibling storefronts, and the wider shared-codebase family, and will report material changes.