Well, maybe its possible the actual tools are logging in automatically from the victim's iPhone? Then again if it spread so fast maybe it was published somewhere (maybe just not in our part of the internet ).