Infoblox Maps Underground Market for iPhone Unlocking Tools and Related Phishing Sites

Cybersecurity researchers have mapped an underground ecosystem that supplies criminals with tools to unlock stolen iPhones and launch phishing attacks against their owners' contacts. Infoblox researchers started looking into the stolen-phone unlocking economy earlier this year after a law-enforcement-related contact in Asia had their iPhone stolen and received a phishing message after including alternative contact details on the locked device.

The phishing page mimicked an Apple Find My page, showed a false map with the phone’s location, and then showed a pop-up asking for the phone’s PIN code.

Infoblox tracked dozens of groups selling unlocking tools, mostly focused on iPhones, and linked more than 10,000 phishing websites to the stolen iPhone unlocking activity. Traffic to these phishing domains increased 350 percent last year. The average cost of the pay-per-use unlocking software is below $10.

“Reselling is 100 percent what they are going for and people from all around the world appear to be buying access to the pay-per-use software,” Maël Le Touz, a staff threat researcher at Infoblox, stated. ” Around 80,000 devices were taken in London in one year.

“Phone thieves don’t just want the handset—they want access to bank accounts and personal information,” Will Lyne, the head of economic and cybercrime at London’s Metropolitan Police, stated.

Four men were caught handling more than 5,000 stolen phones and spending money from financial accounts on the devices. Dan Guido, the CEO and cofounder of security firm Trail of Bits and a strategic adviser to mobile security firm iVerify, stated that a stolen phone may only be worth $50 to $200 when it is locked but if you unlock it, it’s worth $500, or it’s worth $1,000.

Numerous people online and the Swiss National Cybersecurity Center have reported receiving phishing messages after losing or having their iPhones stolen.

The Swiss National Cybersecurity Center reported in November that to make the messages look convincing, attackers include accurate details of the missing device such as its model, colour, and storage capacity which the scammers can read directly from the phone itself.

The Swiss National Cybersecurity Center stated that as there is no known way to bypass this lock, tricking the owner through social engineering is the only realistic option for criminals. Infoblox researchers created DNS fingerprints for the phishing domain and tracked other related Apple look-alike websites.

Some of the tracked websites exposed their administration login pages and advertised tools to unlock phones. Infoblox researchers identified multiple groups on Telegram pushing unlocking services. The unlocking services commonly feature unlocking tools that claim to jailbreak older iPhones or Android devices and pull owner information from phones, phishing kits referred to as Find My iPhone Off, and scripts and AI voice calling software to run the phishing operations.

“What you need first of all is physical access to the phone and if jailbreaks do not work some of the systems can be used to launch phishing attacks and collect unlocking information,” Maël Le Touz stated. All the tools analyzed wipe the device by default as soon as access is attained.

A video obtained by the researchers shows software called iRealm generating phishing links and pages mimicking Apple services.

After WIRED contacted Telegram about the phone unlocking channels, Telegram removed half a dozen groups linked to the services. A Telegram spokesperson stated that phishing and the promotion of tools that enable it can and does happen through every method of communication from messengers to email to phone calls and that the platform has industry-leading moderation.

Apple did not respond to WIRED’s request for comment by the time of publication.

Wired reported these findings.