Are iPhone Farms The Next Billion Dollar Criminal Enterprise?

Forbes

07-04-2025

Image of the Messages icon.
getty
Security researchers have discovered sophisticated criminal operations using banks of iPhones called "iPhone farms" to send over 100,000 scam messages daily through Apple's encrypted iMessage system, as reported by 9to5Mac. Unlike traditional scam texts, these attacks bypass standard carrier security protections by exploiting the trusted nature of Apple's messaging platform.
An iPhone farm is a collection of physical iPhones connected to create a messaging factory. These operations use temporary, rotating Apple IDs to distribute phishing messages at scale while evading detection. Each device can send thousands of messages before switching identities, making blocking these attacks nearly impossible for mobile carriers.
The blue bubble that appears on iMessage Apple's proprietary messaging system creates an immediate sense of trust for many users. By using iMessages rather than texts, scammers can bypass spam and scam filters implemented by mobile carriers. Most people have been trained to be suspicious of strange SMS texts, but messages from fellow Apple users often bypass our psychological defenses.
The criminal masterminds behind these operations have created an entirely new business model: Phishing as a Service, or PhaaS. Fraudsters don't even need any technical skills to carry out their attacks, as there are companies offering phishing as a service. Just as legitimate companies offer Software as a Service, these criminal enterprises now provide turnkey scamming infrastructure to anyone willing to pay.
The research from security firm Catalyst reveals that these services have created a democratized criminal marketplace. A Telegram group used to sell these PhAAS attacks has more than 2,000 members. Technical barriers that once limited scamming operations have disappeared, allowing anyone with criminal intent to launch enterprise grade attacks.
One platform identified by the researchers, Lucid, is operated by threat actors from China and targets victims across 88 countries. This represents a shift from opportunistic criminal activity to organized, industrial scale operations.
One group called the XinXin group was seen putting phishing templates on sale. These are created to copy postal services, tax refunds and even road toll fee systems. This level of professionalism and scale transforms what was once small time fraud into a potential billion dollar criminal industry.
End to end encryption, a technology designed to secure communications from prying eyes, has become a double edged sword. Research experts at Catalyst say that scammers are switching to iMessage as they're encrypted. Networks cannot see the material, so they aren't ever blocked or highlighted.
When messages are sent through iMessage, they're encrypted on the sender's device and can only be decrypted by the intended recipient. This means neither Apple nor mobile carriers can see or filter the message content while in transit creating a perfect delivery mechanism for scammers.
These criminal operations have perfected their techniques through experimentation and analytics. Common scams doing the rounds at present include fake demands for unpaid road toll fees, claims that shipping fees are needed to release valuable packages from Customs and fictitious warnings about unpaid taxes.
Each message typically contains a link to a professional looking but fraudulent website designed to steal credentials or payment information. Some scammers go all the way to produce convincing looking alternatives to pages for organizations that seem so real, like a courier service.
What makes these scams effective is the creation of artificial urgency. Never click on these phishing links seen in emails. If there's any message asking for a quick acceptance or forcing you to act immediately to avoid a fee, there is high likelihood that something is wrong.
As these attacks become more sophisticated, digital self defense becomes essential. The main safeguard against phishing attacks is to never click on links sent in emails. Always use your own bookmarks, or type in a known URL.
Additional protection strategies include:
These iPhone farms represent significant investment sometimes millions of dollars in equipment and infrastructure suggesting extraordinary profit potential. It's all very scalable, and the subscription based designs enable cybercriminals to carry out large scale phishing attempts. These can harvest sensitive details like credit cards for matters like money fraud.
The economics are compelling for criminals. The subscription model for phishing services creates recurring revenue streams for criminal enterprises, paralleling legitimate SaaS business models. This financial stability allows for continuous refinement of techniques and greater operational sophistication.
Apple now faces difficult questions about how to maintain its encryption standards while combating abuse. Traditional carrier based filtering becomes ineffective when messages travel exclusively through Apple's encrypted channels.
The company may need to develop advanced on device detection systems that respect privacy while identifying suspicious message patterns. This technical challenge sits at the intersection of security, privacy and user experience.