News
- SOCRadar uncovers AnonyMousKIT, a phishing kit abusing Apple’s Lost Mode contact info
- Crooks spoof Find My pages, trick victims into giving credentials to unlock stolen iPhones
- Active since 2024, it operates like a criminal software business with 500+ domains and AI‑driven vishing
Security researchers have discovered AnonyMousKIT, a new phishing kit designed to bypass the last line of defense for stolen iPhones, which has been in use for more than two years.
Apple devices come with several anti-theft mechanisms working together to make iPhones a lot less attractive to thieves, including Find My, Activation Lock, and Lost Mode.
If a user’s device is lost or stolen, they can use their tablet, laptop, or a similar device to enable Find My iPhone, which can then locate the device through an app or a website. They can also see its location on a map, make it play a sound, remotely wipe it, or receive a notification when it’s found. Enabling the Find My feature also turns on Activation Lock, which locks the phone and prevents it from being set up by someone else.
Even if the thief factory resets it, the phone remains connected to the real owner’s Apple account, and they simply can’t set it up. To do that, they would need the iPhone device passcode to exit Lost Mode, and the Apple account password, if Activation Lock/setup authentication is required.
But there is another feature Apple added, just in case the device isn’t actually stolen, but rather lost. For these occasions, there is an option to display the owner’s contact information on the screen so that a good samaritan who finds it can return it to its rightful owner.
As is the case with many other well-intended features, this one is now also being abused as part of the AnonyMousKIT phishing kit.
This is why we can't have nice thingsAccording to security researchers SOCRadar, crooks are using AnonyMousKIT to create fake Find My or Apple pages. Then, they use the contact information displayed on the stolen iPhone to reach out to the victim. Through the kit, they can send emails, SMS messages, WhatsApp texts, or even AI-powered phone calls. Reaching out to the victim, the attackers introduce themselves as Apple customer support agents, and tell the victim their smartphone had been retrieved.
They also provide the victim with the correct model and IMEI details to confirm the authenticity of their claims. Then they require the victim to confirm their identity by visiting the spoofed Find My page and providing the credentials needed to unlock the phone.
The credentials end up with the attackers, who can then unlock the phone, wipe it, and sell it on the black market for a much higher price.
"Software business"SOCRadar says the earliest records of the AnonyMousKIT date back to early 2024. Since then it has grown into a major operation, counting more than 500 domains, and having more than 150 storefront brands working as resellers and affiliates.
As part of their investigation, the researchers found records of roughly 200 calls, which the crooks made to victims between August 2025 and May 2026. The calls were done using five different AI agent personas and 55 different interaction transcripts.
Every call had cost the attackers $0.10, and most of them - 90% - were made to Brazilian victims. A small percentage of email correspondence was made towards government and corporate addresses, as well. Just under 30 attempts were made towards South African government domains, and three to a local university. While the campaign is global in its reach, it’s mostly focused on South Africa, Indonesia, India, Kenya, Brazil, and Italy.
SOCRadar describes AnonyMousKIT "not as a phishing kit but as a small software business with a criminal customer base."
"Its primary innovation is an automated, LLM-driven voice vector. At ~$0.10 per call, the platform initiates dynamic vishing across three languages using structured pretexts synced with email and SMS lure data, removing the need for fluent human callers."
At the moment the report was published, the campaign was still ongoing, and the researchers are still tracking it.
Via BleepingComputer
- The FDA has approved the Libre Duo 10 Day CGM wearable
- It can continuously measure both ketones and blood sugar levels
- It’s worn by diabetics as a continuous glucose monitor (CGM)
The US Food and Drug Administration (FDA) has approved the first wearable device capable of simultaneously monitoring both ketone and bloody sugar levels, which the organization says is “a breakthrough for the safety of children and adults living with diabetes".
The device in question is the Libre Duo 10 Day monitor. Worn on your arm as a continuous glucose monitor (CGM), it provides minute-by-minute glucose updates that are sent to your smartphone. It also monitors ketone levels and sends you an alert if they rise above a certain threshold.
In terms of who can use it, the Libre Duo 10 Day wearable has been approved for use by people aged two or over who are living with diabetes. It takes the form of a small wearable sensor that measures glucose and ketone levels held within the fluids under your skin.
Made by Abbott Diabetes Care, there are few other specific details about the device for the time being, but the potential is huge.
Simplifying the process(Image credit: Abbott Diabetes Care)In approving the Libre Duo 10 Day, the FDA’s intention is to help prevent diabetic ketoacidosis (DKA). This condition occurs when your body starts using fat instead of glucose for energy, which in turn leads to it producing too much ketone. DKA can become a life-threatening medical emergency if left untreated.
One of the benefits of the Libre Duo 10 Day is that it can track ketone levels in real time. Rather than using a standalone test kit that only provides a snapshot of your situation in that exact moment, the Libre wearable can display trends over time, notifying you if your ketone levels are rising or falling — which could help keep you better informed of whether your risk of DKA is changing.
The fact that it combines ketone monitoring with blood sugar analysis also means you don’t need two separate devices in order to stay on top of your diabetes. Having a single wearable helps keep things straightforward.
We don’t know when the Libre Duo 10 Day will become available, and its manufacturer’s website simply says it is “coming soon.” When it does arrive, it might help simplify the process of ketone and blood sugar monitoring for the 2.1 million Americans with type 1 diabetes for whom DKA is a real threat.
- ShinyHunters adds CyrusOne to its victim list, demanding $13m ransom
- Claimed theft includes 12.9 million Salesforce records, 600GB SharePoint data, PII, contracts, and facility diagrams
- Breach could enable physical intrusions and supply‑chain attacks; CyrusOne has not commented or paid
The infamous ShinyHunters ransomware crew has added CyrusOne, a major US data center operator, to its list of victims, claiming to have stolen a treasure trove of highly sensitive data which, if proven true, could turn this into a bonafide catastrophe for the company and its customers.
Overall, ShinyHunters claims to have exfiltrated 12.9 million Salesforce records, more than 182,000 rows from the Salesforce Contacts object, more than 600 GB of SharePoint data, more than 8,300 employee records containing personally identifiable information (PII), executed contracts, master service agreements, NDAs, and service agreements, data center floor plans, electrical diagrams, access-control records and badge audits, physical key inventories, security policies, critical Environment Reliability Management documentation, and various passwords and credential artifacts.
No samples have been posted just yet, but researchers don’t see it as suspicious, but rather as a pressure tactic.
What makes this attack differentIn exchange for deleting all of the stolen data, ShinyHunters is demanding $13 million from CyrusOne which, at this time, is not commenting on the claims, and is seemingly not interested in negotiations.
“They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records,” the attackers allegedly wrote.
Ransomware groups steal sensitive corporate data all the time, but this incident has the potential to be among the most devastating data breaches ever. Some of the secrets that were nabbed cannot simply be changed: data center floor plans, electrical diagrams, access-control records, badge audits, physical key inventories, this kind of intelligence can be used for physical breaches.
If criminals know how keys are assigned, how the data center is organized, where surveillance cameras are located, and how guards operate, it makes it easier to physically break it.
“You can’t patch a building,” the researchers warned, noting that some of the things that can be changed, such as physical keys and access zones, still take months and “real money”, they added, hinting at just how big the problem could be.
CyrusOne runs some 50 facilities all across the United States and serves hundreds of companies and corporations. Some of its clients include Fortune 1000 companies, as well as big tech names such as Microsoft, Meta, Verizon, AT&T, IBM, and CME Group.
Compounding the problem even further is the fact that ShinyHunters stole information about CyrusOne’s customers, such as Meta, or Microsoft. Information about the locations of certain customers, the services they’re paying for, the NDAs, service-level agreements, and contact information, can all be used for highly tailored, sophisticated phishing attacks that could turn this incident into an unprecedented third-party supply-chain attack.
“Contracts, MSAs, and NDAs identify the tenants as a customer list overlaid on a building map, with pricing and SLAs attached,” the researchers added.
No reactionTo add insult to injury, ShinyHunters also seems to have stolen information about the company’s power, cooling, and critical-environment reliability processes, which they could leverage to physically attack the servers, causing disruptions, outages, and possibly fires.
The group first added CyrusOne to their site on August 20 2026, although at that moment, the name of the victim was redacted, the researchers said. Instead, ShinyHunters posted a warning, saying “Final warning - pay or leak”. The company was given until August 24 to reach out which, it would seem, did not happen.
Three days later, on August 23, ShinyHunters publicly named CyrusOne as their victim, and stated that they demanded $13 million for the files. We are now well past the deadline, and nothing’s changed - the victim hasn’t spoken out, and ShinyHunters did not leak the files.
Via Cybernews
- Researcher registers Linux machine as a trusted device on Apple's Find My network and pulled live people-tracking data that Apple normally reserves for its own hardware
- The work is not a mass-surveillance exploit: it is limited in scope and only reads a location share that a friend had already agreed to, and it cannot silently locate arbitrary Apple users
- The approach took less than a week of protocol reverse engineering, and Apple has maintained silence on queries about the technique employed
Apple keeps the full Find My experience locked to its own devices, but a recent attempt by security researchers suggests that wall may be a relatively weak barrier to entry.
A 22-year-old security researcher who goes by "Zerotistic" documented how they registered an ordinary Linux machine as a trusted node on Apple's network and used its new status to receive live people-location data that Apple otherwise shares only with its own devices, such as iPhones and iPads.
Find My, Apple's catch-all tool for locating hardware such as AirTags, iPhones, and iPads, also lets people share their whereabouts with family and friends, and while Apple has historically guarded this particular feature very closely, it is also the same one the security researcher targeted to introduce a device that Apple does not otherwise have complete control over as part of its ecosystem.
An interesting trick that still requires consent to get the job doneThe task is not an easy one to begin with: convincing Apple's back end that a Linux process was a legitimate Apple device that was part of its ecosystem and therefore could be trusted with information shared via the Find My platform required a lot of trial and error to get going.
It is important to clarify here that Apple's system is not exactly compromised here; the approach still requires a friend to share data that the Linux client that the security researcher built can then read.
Apple currently sends people-location data over its private Push Notification service only after it trusts that the receiving machine belongs to the account and can handle the data. This means the Linux machine would have to speak Apple's private language to query its servers and process the information it received.
It involved obtaining an Apple Identity Services (IDS) certificate, a specialized device and messaging credential Apple's internal framework uses to link an Apple Account to specific hardware, end-to-end encryption keys, and push notification tokens. This meant crafting a certificate signing request and sending it to a legacy Apple enrollment endpoint.
Once done, a Linux box with a signed certificate could sign its own requests and register as a Find My device, but it still had to subscribe to six different subservices to function. The registration request also had to be signed using an IDS certificate and an APNs certificate obtained during initial network setup.
The researcher then issued a SubscribeAndFetch request that provided an encrypted location key from his friend's Apple device to the Linux box, masquerading as one.
What might concern Apple is how fast things moved: the whole pipeline came together in a week. It also didn't require a jailbreak, a leaked key, or even a Mac to do the job. Instead, open-source clients and decompiled daemons were the norm, with a trial-and-error approach that eventually paid off.
The technique has its limitations: attacks can not target a stranger, and consent is required to track even one's friends. It shows that Apple's boundary around Find My stems from an obscure protocol it enforces rather than a cryptographic lock; once a device acts like it is from Apple, the ecosystem treats it as a family member rather than an untrusted node.
Apple has yet to respond to media queries about whether it plans to address the demonstrated trick or patch the loop in the near future.
- A new leak sheds fresh light on the Samsung Galaxy Aero smartwatch
- The device might ditch Wear OS and use the RTOS operating system instead
- It could fix some of the mistakes of the Samsung Galaxy Watch FE
It’s safe to say that we weren’t huge fans of the Samsung Galaxy Watch FE, with our reviewer scoring it a measly two stars and branding it “one of the most confusing smartwatches I’ve ever tested.” Yet despite the disappointment, a new leak suggests that Samsung is going to take another stab at the entry-level smartwatch market — but the result might look very different.
The latest hints come from Gadgets & Wearables, which investigated the Samsung Health and Galaxy Wearable apps to uncover hints of what might be to come. And according to the news outlet, the forthcoming device could take the form of a new Samsung watch dubbed the Galaxy Aero.
What’s interesting about this product is that, unlike many of the best Samsung watches, it might not run on Google’s Wear OS. Previous reporting from SamMobile found hints pointing towards the use of RTOS, or ‘real-time operating system,’ as Samsung software contained references to ‘Galaxy Aero’ and ‘galaxy_rtos_watch.’ The implication here is that these devices were the same product.
RTOS is the platform that Samsung’s Galaxy Fit devices run on and is a far more lightweight system than Wear OS. If RTOS ends up powering the Galaxy Aero, it would suggest that the product will be at the lower end of Samsung’s wearable spectrum.
Further investigation from Gadgets & Wearables suggests that several Samsung apps and services have the capability of handling RTOS and devices that use it. And it’s that capability that supposedly opening the door for the Galaxy Aero.
Righting the wrongs of the past(Image credit: Future)One of our main criticisms of the Samsung Galaxy Watch FE was that it was strangely positioned — at the time, it offered worse performance than the Samsung Galaxy Watch 6, despite being available to buy for the same price or more. With the Galaxy Aero, that uncomfortable quirk might be remedied.
That’s because SamMobile suggests it could be priced below the Watch FE, making it a more sensible proposition for a low-cost smartwatch. If true, that could make it much less of a tough sell.
And there’s another consideration. By using RTOS instead of Wear OS, Samsung could conceivably cut down on battery usage, solving another major problem with the Watch FE. It would mean making some compromises, with limited support for the Google Play Store and third-party apps both possible. But if Samsung can keep the cost down, it’s likely that many users won’t mind.
If Samsung makes that move, it would join rivals like Amazfit and Huawei in launching an affordable fitness tracker that doesn’t rely on Wear OS. Whether it can right the wrongs of the Galaxy Watch FE, however, remains to be seen.
- OpenAI says it has disrupted a social media influence campaign that is believed to be of Russian origin
- What makes this campaign stand out is the underlying architecture, which features a "think tank" with highly questionable credibility
- The objective of the campaign was to influence Western audiences into believing Russia was superior, and that Western countries were sacrificing their sovereignty
AI tools have once again been used for bad, rather than for good, and this time it has been as part of a campaign attributed to Russia that tried to discredit Western countries supportive of Ukraine.
The threat actors used ChatGPT accounts to promote the work of an “expert community” of academics known as the International Burke Institute (IBI). The site used stolen academic works attributed to the wrong authors in an attempt to appear legitimate while also hiding the true source of its academic ‘contributions’.
The IBI was registered to an address in Israel - with some evidence suggesting real individuals in Israel represented and promoted the page - but the main purpose of the misinformation campaign was to paint Russia in a favourable light compared to its Western adversaries.
International Burke Institute, or an institute run by international berks?In its report on the campaign OpenAI points out that those behind the ChatGPT accounts used to promote the page took careful steps to hide their Russian origins. Many of the prompts included instructions to hide any linguistic clues that the operators used Russian language prompting.
One inclusion on the IBI website referred to Germany’s traffic light coalition as the “Svetofor coalition”. Svetofor is the word for ‘traffic light’ in numerous Slavic languages, including Russian, indicating that drafts were written in Slavic languages before being translated.
Some of the accounts were used to promote the IBI across X, LinkedIn, Facebook, Substack and Telegram with AI generated imagery and captions, with other accounts being used to automatically engage with comments by real users on Substack. The operators of the ChatGPT accounts regularly requested performance summaries of these pages in Russian, and used ChatGPT to generate matching profile pictures for some accounts.
Burke Sovereignty IndexOne of the features of the IBI website is to advertise the ‘Burke Sovereignty Index’ - designed to measure how well a country performs compared to others across political, economic, technological, informational, cultural, cognitive and military factors.
The Index’s purpose is to make Western countries appear worse than Russia, OpenAI says. Having taken a look at the Index myself it's clear there is no consistency in measurement or comparison. For example, The Vatican City - which is less than half a square kilometer in size - sits above Spain in its average of scores. The Index also gave Russia the highest military score.
Questionable expert contributorsThe website also includes a list of experts, whose affiliation to the IBI is not referenced. Some among them are pioneers in their fields of study, such as Francis Fukuyama and Noam Chomsky.
Others are former high-ranking members of the US government, such as Mike Pompeo and Joseph Nye. There are even listings for experts who passed away before the IBI was founded, such as Shlomo Avineri and Jiang Ping.
Much of the academic work cited on the IBI website is legitimate, but more often than not has been stolen from its actual author and misattributed to a different author to hide the work’s actual source, OpenAI said. This has been done to give the IBI website credibility and to make it appear authentic.
Impact of the IBI influence campaignThe overall impact of the IBI and its promotion using social media and ChatGPT is fairly limited, OpenAI noted. Some of the Telegram channels garnered followings between ten to twenty thousand showing a limited breakout to authentic audiences.
But the main thing to take away from this is the level of dedication placed behind the underlying infrastructure of the IBI. The site is designed to look authentic, uses authentic research (even if it is wrongly attributed), and presents itself as a collection of experts. To the layman, a cursory glance at the IBI website would give any of their social media presence a level of authenticity not seen in other social influence campaigns.