AnonyMousKIT AI-Powered PhaaS Supply Chain: OTX Pulse Analysis — Apple Activation Lock Credential Harvesting Detection Pack

---
title: AnonyMousKIT PhaaS Lure Domain Connection
id: 8f3a1b2c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects outbound network connections or DNS resolutions to known AnonyMousKIT PhaaS credential-harvesting domains used in Apple Activation Lock phishing campaigns.
author: Security Arsenal Threat Intelligence
references:
  - https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain
date: 2026/08/30
modified: 2026/08/30
logsource:
  category: dns
detection:
  selection_domain:
    query|contains:
      - 'apple-unlock.com'
      - 'buscar-lphone.com'
      - 'suporte-lcloud.com'
      - 'com-maps.info'
      - 'findmy-dispositivos.com'
      - 'id-ubicacion.com'
      - 'findsupport.live'
      - 'zu7pl.pro'
  condition: selection_domain
falsepositives:
  - Unlikely; these domains have no legitimate business purpose
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1566.002
  - attack.credential_access
  - attack.t1056
---
title: AnonyMousKIT PhaaS Lure Pattern in Web Proxy Logs
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP/HTTPS requests matching AnonyMousKIT lure domain naming patterns (Apple/iCloud/Find My themed look-alike domains) even when the exact IOC domain is not yet known.
author: Security Arsenal Threat Intelligence
references:
  - https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain
date: 2026/08/30
modified: 2026/08/30
logsource:
  category: proxy
detection:
  selection_pattern:
    c-uri|contains:
      - 'apple-unlock'
      - 'icloud-verify'
      - 'findmy-'
      - 'buscar-lphone'
      - 'suporte-lcloud'
      - 'ubicacion'
      - 'dispositivos'
      - 'activation-lock'
      - 'findsupport'
  filter_legit:
    c-uri|contains:
      - 'apple.com'
      - 'icloud.com'
      - 'apple-dns.net'
      - 'mzstatic.com'
      - 'itunes.apple.com'
  condition: selection_pattern and not filter_legit
falsepositives:
  - Legitimate third-party Apple repair sites (review before enforcement)
  - Regional device-locator services
level: medium
tags:
  - attack.initial_access
  - attack.t1566
  - attack.credential_access
  - attack.t1539
---
title: Credential Entry After Phishing Redirect — Browser Spawned From Comm Channel
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects a browser process launched by an email client, SMS-linked handler, or messaging application — a common artifact of users clicking AnonyMousKIT phishing links delivered via email, SMS, or WhatsApp.
author: Security Arsenal Threat Intelligence
references:
  - https://socradar.io/blog/anonymouskit-ai-phaas-supply-chain
date: 2026/08/30
modified: 2026/08/30
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\WhatsApp.exe'
      - '\WhatsApp.Root.exe'
      - '\ms-teams.exe'
      - '\Telegram.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  filter_common:
    CommandLine|contains:
      - '--type='
      - '--crashpad-handler'
      - 'about:blank'
  condition: selection_parent and selection_child and not filter_common
falsepositives:
  - Legitimate link clicks from email and chat; tune by correlating with DNS hits to lure-pattern domains
level: medium
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001

// AnonyMousKIT PhaaS — Retro-hunt for lure domain contact and phishing-driven browser launches
// Microsoft Sentinel / Microsoft 365 Defender | Lookback: 90 days

let Lookback = 90d;
let PhaaSDomains = dynamic([
  "apple-unlock.com", "buscar-lphone.com", "suporte-lcloud.com", "com-maps.info",
  "findmy-dispositivos.com", "id-ubicacion.com", "findsupport.live", "zu7pl.pro"
]);
let PhaaSPatterns = dynamic([
  "apple-unlock", "icloud-verify", "findmy-", "buscar-lphone", "suporte-lcloud",
  "ubicacion", "activation-lock", "findsupport"
]);
// Part 1: Direct DNS/Network hits to known AnonyMousKIT domains
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (PhaaSDomains)
    | project HitType="NetworkEvent", TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, AccountName;
let DnsHits =
    DeviceEvents
    | where TimeGenerated > ago(Lookback)
    | where ActionType == "DnsQueryResponse"
    | extend QueriedDomain = tostring(parse_json(AdditionalFields).DnsQueryString)
    | where QueriedDomain has_any (PhaaSDomains)
       or QueriedDomain has_any (PhaaSPatterns)
    | project HitType="DnsQuery", TimeGenerated, DeviceName, InitiatingProcessFileName = FileName,
              InitiatingProcessCommandLine = ProcessCommandLine, RemoteUrl = QueriedDomain, RemoteIP = "", AccountName;
// Part 2: Browser launched by email/chat clients within 5 min of a domain hit (phish click-through)
let SuspectClicks =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName has_any ("outlook.exe", "thunderbird.exe", "WhatsApp.exe", "Telegram.exe")
    | where FileName has_any ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
    | where ProcessCommandLine !has "--type="
    | project ClickTime = TimeGenerated, DeviceName, AccountName, BrowserCmd = ProcessCommandLine,
              InitiatingProcessFileName;
union NetworkHits, DnsHits
| join kind=leftouter SuspectClicks on DeviceName
| where isempty(ClickTime) or abs(datetime_diff('minute', ClickTime, TimeGenerated)) <= 5
| sort by TimeGenerated desc
| summarize Hits = count(), DistinctDevices = dcount(DeviceName), FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated) by RemoteUrl, HitType, DeviceName, AccountName
| order by LastSeen desc;

#requires -Version 5.1
<#
.SYNOPSIS
    AnonyMousKIT PhaaS Endpoint Hunt — Security Arsenal Threat Intelligence
.DESCRIPTION
    Hunts a Windows endpoint for evidence of interaction with AnonyMousKIT
    credential-harvesting infrastructure:
      1. DNS client cache entries for known IOC domains and lure patterns
      2. Browser history (Chrome/Edge/Firefox) visits to lure domains
      3. Active or historical TCP connections to PhaaS infrastructure
      4. Hosts file tampering referencing Apple/iCloud themed domains
      5. Recently created browser credential-store access artifacts
    Run as Administrator for full visibility. Output written to CSV.
#>

$ErrorActionPreference = 'SilentlyContinue'
$OutDir = "C:\AnonyMousKIT_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss')"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

$IocDomains = @(
    'apple-unlock.com','buscar-lphone.com','suporte-lcloud.com','com-maps.info',
    'findmy-dispositivos.com','id-ubicacion.com','findsupport.live','zu7pl.pro'
)
$LurePatterns = @(
    'apple-unlock','icloud-verify','findmy-','buscar-lphone','suporte-lcloud',
    'ubicacion','activation-lock','findsupport','dispositivos'
)

$Findings = @()

Write-Host "[+] [1/5] Checking DNS client cache..." -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache
foreach ($entry in $DnsCache) {
    foreach ($ioc in $IocDomains) {
        if ($entry.Entry -like "*$ioc*") {
            $Findings += [PSCustomObject]@{
                Category='DNSCache-IOC'; Indicator=$ioc; Evidence="$($entry.Entry) -> $($entry.Data)"; Source=$entry.Name
            }
        }
    }
    foreach ($pat in $LurePatterns) {
        if ($entry.Entry -like "*$pat*" -and $entry.Entry -notlike '*apple.com*' -and $entry.Entry -notlike '*icloud.com*') {
            $Findings += [PSCustomObject]@{
                Category='DNSCache-Pattern'; Indicator=$pat; Evidence="$($entry.Entry) -> $($entry.Data)"; Source=$entry.Name
            }
        }
    }
}

Write-Host "[+] [2/5] Parsing browser history (Chrome/Edge/Firefox)..." -ForegroundColor Cyan
$browserPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\*\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\*\History",
    "$env:APPDATA\Mozilla\Firefox\Profiles\*\places.sqlite"
)
foreach ($bp in $browserPaths) {
    foreach ($hist in (Get-Item $bp)) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString('N'))
        Copy-Item $hist.FullName $tmp -Force
        try {
            # Lightweight binary string scan — no SQLite dependency
            $bytes = [System.IO.File]::ReadAllBytes($tmp)
            $text  = [System.Text.Encoding]::UTF8.GetString($bytes)
            foreach ($ioc in $IocDomains) {
                if ($text -match [regex]::Escape($ioc)) {
                    $Findings += [PSCustomObject]@{
                        Category='BrowserHistory-IOC'; Indicator=$ioc; Evidence="Match in $($hist.FullName)"; Source='BrowserHistory'
                    }
                }
            }
            foreach ($pat in $LurePatterns) {
                if ($text -match [regex]::Escape($pat)) {
                    $Findings += [PSCustomObject]@{
                        Category='BrowserHistory-Pattern'; Indicator=$pat; Evidence="Match in $($hist.FullName)"; Source='BrowserHistory'
                    }
                }
            }
        } finally { Remove-Item $tmp -Force }
    }
}

Write-Host "[+] [3/5] Checking active TCP connections and Netstat history..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' }
foreach ($c in $conns) {
    try {
        $resolved = (Resolve-DnsName $c.RemoteAddress -ErrorAction Stop).NameHost
    } catch { $resolved = $null }
    if ($resolved) {
        foreach ($ioc in $IocDomains) {
            if ($resolved -like "*$ioc*") {
                $proc = (Get-Process -Id $c.OwningProcess).ProcessName
                $Findings += [PSCustomObject]@{
                    Category='ActiveConnection-IOC'; Indicator=$ioc
                    Evidence="PID $($c.OwningProcess) ($proc) -> $resolved ($($c.RemoteAddress):$($c.RemotePort))"
                    Source='NetTCPConnection'
                }
            }
        }
    }
}

Write-Host "[+] [4/5] Checking hosts file for Apple/iCloud redirect tampering..." -ForegroundColor Cyan
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$hostsEntries = Get-Content $hostsPath | Where-Object { $_ -notmatch '^\s*#' -and $_ -match '\S' }
foreach ($line in $hostsEntries) {
    if ($line -match 'apple|icloud|findmy|itunes') {
        $Findings += [PSCustomObject]@{
            Category='HostsFile-Tamper'; Indicator='Apple/iCloud redirect'; Evidence=$line.Trim(); Source=$hostsPath
        }
    }
}

Write-Host "[+] [5/5] Checking for suspicious credential-store access events (Event 4662/4656 on Login Data)..." -ForegroundColor Cyan
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4663,4656; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 500
foreach ($ev in $events) {
    if ($ev.Message -match 'Login Data|Cookies|Web Data' -and $ev.Message -notmatch 'chrome\.exe|msedge\.exe') {
        $Findings += [PSCustomObject]@{
            Category='CredStore-Access'; Indicator='Non-browser access to browser credential store'
            Evidence=$ev.Message.Substring(0,[Math]::Min(200,$ev.Message.Length)); Source="EventID $($ev.Id) @ $($ev.TimeCreated)"
        }
    }
}

if ($Findings.Count -gt 0) {
    $Findings | Export-Csv -Path "$OutDir\AnonyMousKIT_Findings.csv" -NoTypeInformation
    Write-Host "[!] $($Findings.Count) finding(s) detected. Report: $OutDir\AnonyMousKIT_Findings.csv" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
} else {
    Write-Host "[OK] No AnonyMousKIT PhaaS indicators found on this host." -ForegroundColor Green
}