AnonyMousKIT AI-Powered PhaaS Supply Chain: 506-Domain Apple Activation Lock Phishing Network — OTX Detection Pack

---
title: DNS Query to AnonyMousKIT PhaaS Phishing Domain
id: 8f3a1b2c-4d5e-4f6a-9b7c-1a2b3c4d5e6f
status: experimental
description: Detects DNS resolution of known AnonyMousKIT Apple Activation Lock phishing infrastructure per OTX pulse 2026-09-26
references:
  - https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain
author: Security Arsenal Threat Intel
date: 2026/09/26
tags:
  - attack.t1566
  - attack.t1656
logsource:
  category: dns
detection:
  selection_domains:
    query|contains:
      - 'apple-unlock.com'
      - 'buscar-lphone.com'
      - 'suporte-lcloud.com'
      - 'com-maps.info'
      - 'findmy-dispositivos.com'
      - 'id-ubicacion.com'
      - 'findsupport.live'
      - 'zu7pl.pro'
  condition: selection_domains
falsepositives:
  - None expected; these are malicious phishing domains
level: high
---
title: Apple Brand Lookalike Domain Resolution (PhaaS Pattern)
id: 9a4b2c3d-5e6f-4a7b-8c9d-2b3c4d5e6f7a
status: experimental
description: Detects DNS lookups matching AnonyMousKIT domain naming conventions - iCloud/iPhone character-substitution lookalikes and Find My lure keywords
author: Security Arsenal Threat Intel
date: 2026/09/26
tags:
  - attack.t1566
  - attack.t1583.001
logsource:
  category: dns
detection:
  selection_lookalike:
    query|contains:
      - '-lcloud.'
      - '-lphone.'
      - 'apple-unlock'
      - 'appleid-'
  selection_lure:
    query|contains:
      - 'findmy-'
      - '-ubicacion.'
      - '-dispositivos.'
      - 'buscar-'
      - 'suporte-'
  filter_legit:
    query|contains:
      - 'apple.com'
      - 'icloud.com'
      - 'apple-dns.net'
      - 'mzstatic.com'
  condition: (selection_lookalike or selection_lure) and not filter_legit
falsepositives:
  - Legitimate localization or support services using these keywords; whitelist after verification
level: medium
---
title: Browser Access to Apple Credential Phishing Portal
id: 7c5d6e7f-8a9b-4c0d-1e2f-3c4d5e6f7a8b
status: experimental
description: Detects HTTP requests containing Apple ID auth URI patterns directed at non-Apple domains, consistent with AnonyMousKIT AiTM credential harvesting portals
author: Security Arsenal Threat Intel
date: 2026/09/26
tags:
  - attack.t1566.002
  - attack.t1078
logsource:
  category: proxy
detection:
  selection_uri:
    c-uri|contains:
      - '/appleid/auth'
      - '/IDMSWebAuth'
      - '/signin'
      - '/activate'
      - '/unlock'
  selection_ua_mobile:
    c-useragent|contains:
      - 'iPhone'
      - 'iOS'
  filter_apple:
    cs-host|endswith:
      - '.apple.com'
      - '.icloud.com'
  condition: selection_uri and selection_ua_mobile and not filter_apple
falsepositives:
  - MDM enrollment flows; enterprise SSO proxies — validate destination domain against Apple AS714 ranges
level: high

// Hunt: AnonyMousKIT phishing domain access + Apple ID credential submission risk
let phaaS_domains = dynamic(["apple-unlock.com","buscar-lphone.com","suporte-lcloud.com","com-maps.info","findmy-dispositivos.com","id-ubicacion.com","findsupport.live","zu7pl.pro"]);
let network_hits = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl has_any (phaaS_domains)
| project NetworkHitTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName;
let dns_hits = DeviceEvents
| where TimeGenerated > ago(90d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(parse_json(AdditionalFields).QueryName)
| where QueryName has_any (phaaS_domains)
| project DnsTime=TimeGenerated, DeviceName, QueryName;
let url_clicks = UrlClickEvents
| where TimeGenerated > ago(90d)
| where Url has_any (phaaS_domains)
| project ClickTime=TimeGenerated, AccountUpn, Url, IsClickedThrough;
network_hits
| join kind=leftouter dns_hits on DeviceName
| join kind=leftouter url_clicks on $left.InitiatingProcessAccountName == $right.AccountUpn
| project NetworkHitTime, DnsTime, ClickTime, DeviceName, InitiatingProcessAccountName, AccountUpn, RemoteUrl, QueryName, Url, IsClickedThrough
| sort by NetworkHitTime asc
// Prioritize rows where IsClickedThrough == 1: credential submission likely, force immediate Apple ID reset

# Security Arsenal - AnonyMousKIT PhaaS IOC Hunt Script
# Checks DNS cache, browser history artifacts, and recent network connections for phishing domain indicators
$IOCs = @(
    'apple-unlock.com','buscar-lphone.com','suporte-lcloud.com','com-maps.info',
    'findmy-dispositivos.com','id-ubicacion.com','findsupport.live','zu7pl.pro'
)
$lookalikePatterns = @('-lcloud.','-lphone.','findmy-','-ubicacion.','-dispositivos.')
$hits = @()

Write-Host "[*] AnonyMousKIT PhaaS Hunt - $(Get-Date -Format 'yyyy-MM-dd HH:mm')" -ForegroundColor Cyan

# 1. DNS client cache
Write-Host "[*] Checking DNS cache..."
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dnsCache) {
    foreach ($ioc in $IOCs) {
        if ($entry.Name -like "*$ioc*") {
            $hits += [PSCustomObject]@{Source='DNSCache'; Indicator=$entry.Name; Type='ExactIOC'; Time='N/A'}
        }
    }
    foreach ($pat in $lookalikePatterns) {
        if ($entry.Name -like "*$pat*" -and $entry.Name -notlike '*apple.com*' -and $entry.Name -notlike '*icloud.com*') {
            $hits += [PSCustomObject]@{Source='DNSCache'; Indicator=$entry.Name; Type='LookalikePattern'; Time='N/A'}
        }
    }
}

# 2. Active/recent TCP connections resolved to suspicious hostnames
Write-Host "[*] Checking active network connections..."
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $remoteHost = try { (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop).NameHost } catch { $null }
    if ($remoteHost) {
        foreach ($ioc in $IOCs) {
            if ($remoteHost -like "*$ioc*") {
                $hits += [PSCustomObject]@{Source='NetConnection'; Indicator=$remoteHost; Type='ActiveC2orPhish'; Time=Get-Date}
            }
        }
    }
}

# 3. Chrome/Edge history (SQLite raw string scan fallback)
Write-Host "[*] Scanning browser history files for IOC strings..."
$histPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $histPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString('N'))
        Copy-Item $hp $tmp -Force -ErrorAction SilentlyContinue
        $raw = [System.IO.File]::ReadAllText($tmp)
        foreach ($ioc in $IOCs) {
            if ($raw -match [regex]::Escape($ioc)) {
                $hits += [PSCustomObject]@{Source='BrowserHistory'; Indicator=$ioc; Type='VisitedPhishPortal'; Time='See history DB'}
            }
        }
        Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    }
}

# 4. Windows DNS Client event log (Event ID 3008-style query names via analytical logs where enabled)
Write-Host "[*] Querying DNS client events (last 7 days)..."
$dnsEvents = Get-WinEvent -LogName 'Microsoft-Windows-DNS-Client/Operational' -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) }
foreach ($ev in $dnsEvents) {
    foreach ($ioc in $IOCs) {
        if ($ev.Message -match [regex]::Escape($ioc)) {
            $hits += [PSCustomObject]@{Source='DNSEventLog'; Indicator=$ioc; Type='HistoricalResolution'; Time=$ev.TimeCreated}
        }
    }
}

# Output
if ($hits.Count -gt 0) {
    Write-Host "[!] $($hits.Count) POTENTIAL COMPROMISE ARTIFACTS FOUND:" -ForegroundColor Red
    $hits | Format-Table -AutoSize
    $hits | Export-Csv -Path ".\AnonyMousKIT_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "[!] ACTION: Any VisitedPhishPortal hit = treat user's Apple ID + SSO credentials as COMPROMISED" -ForegroundColor Red
} else {
    Write-Host "[+] No AnonyMousKIT indicators found on this host." -ForegroundColor Green
}