Ten cents a call: Activation Lock bypass now ships with its own voice agent

The passcode is the part email cannot reliably get. Activation Lock binds a handset to the owner's Apple Account the moment Find My is enabled, survives a factory reset, and demands a valid authorization code at first setup ^[7]. That is why a stolen iPhone destined for parts is worth less than one that can be unlocked, and worth more still if the owner's data travels with it ^[8]. A convincing fake Find My page will collect an Apple Account password and a 2FA code ^[11]. The device passcode is the credential a wary owner is least likely to type into a browser, and the call exists to have it said out loud instead ^[12].

Run the numbers on the recovered log and the scale is modest. Two hundred calls at roughly ten cents ^[5][6] is about twenty dollars of telephony for the entire sample ^[1], with some 180 of those calls placed to Brazilian numbers ^[2]. Across the window from August 2025 to May 2026 that averages around twenty calls a month ^[3]. This is a capability finding rather than a volume one, and SOCRadar obtained it by pulling on the operator's use of bare relative paths ^[3], so what was recovered is what leaked, not necessarily what was dialled.

The harder problem is what the caller already holds. The pretext quotes the device's genuine model and IMEI ^[10], and the owner's phone number and email came from the Lost Mode contact details the owner published themselves in the hope of getting the phone back ^[9]. A verification script that treats device identifiers plus a matching contact number as evidence of identity has the polarity reversed here. The attacker can answer the challenge questions. The person being asked to prove something is the victim, and the proof requested is a secret.

Corporate exposure follows from where the Apple Account sits, not from who was targeted. SOCRadar found a small share of the platform's phishing emails going to government and corporate recipients ^[15], and warns that an account taken this way can reach iCloud backups, Keychain passwords, and work email held on personal or employer-issued hardware ^[14]. The concentration of activity in South Africa, Indonesia, Italy, India, Kenya and Brazil ^[16] tells you where the resale market is, not where the credential eventually lands.

As an enforcement problem, the shape of the estate matters more than the voice agent. SOCRadar counted 506 domains and 168 reseller storefront brands ^[4], which is about three domains per brand ^[4]. Take down a storefront and you have taken down two or three names attached to a service that has been running since early 2024 and that also sells the stolen handsets, harvests Apple IDs, and reads iCloud and Keychain data ^[1][2]. Five personas and 55 distinct transcripts ^[5] are the cheapest assets in that inventory to replace.