From the article >Fahd allegedly recruited AT&T “insiders” to install malware programs that gathered confidential information and submitted unlock requests usi

From the article >Fahd allegedly recruited AT&T “insiders” to install malware programs that gathered confidential information and submitted unlock requests using employee credentials via a remote server. Sounds like the malware was stealing creds to be used to unlock the phones.