By Alex Valdes
Published: September 2026
The anticipation surrounding Apple’s first-ever foldable handset, the iPhone Duo, has reached a fever pitch. However, this excitement has created a lucrative hunting ground for cybercriminals. Cybersecurity researchers at Malwarebytes have uncovered a highly sophisticated, malicious advertising campaign exploiting the buzz around the upcoming device. Posing as an official Apple portal offering an exclusive $500 discount for early sign-ups, the fraudulent campaign relies on the dangerous DarkSword exploit chain to harvest sensitive personal, financial, and cryptocurrency data from unsuspecting Apple users.
While Apple has officially stated that the iPhone Duo will not open for public preorder until October 16, with an in-store release scheduled for October 23, fraudulent web pages are already capitalizing on consumer impatience. Security experts warn that falling victim to this scheme goes far beyond simple phishing; it installs a silent payload capable of stripping a device of its most private data without the user ever clicking a button.
Main Facts: The Anatomy of the DarkSword Campaign
The scam begins with a deceptive advertisement promising a massive $500 voucher toward the purchase of the iPhone Duo. Users who click the link are directed to a meticulously crafted webpage that mimics Apple’s genuine aesthetic down to the last detail.
According to Malwarebytes, the page features authentic Apple typography, branding elements, and layout structures—notoriously absent of the broken grammar and spelling errors that typically give away amateur phishing sites. Even the copyright notice at the bottom appears legitimate. However, critical navigation links, such as the privacy policy and terms of sale, are broken and lead nowhere.
The Silent Threat of the DarkSword Exploit
What makes this attack uniquely dangerous is the integration of the DarkSword exploit chain. Unlike conventional phishing scams that require victims to download a malicious file or input login credentials into a form, DarkSword operates via a drive-by download attack.
- Zero-Click Mechanics: The malicious payload executes the moment the scam webpage loads in the browser. Users do not need to click links, download software, or type information for the compromise to begin.
- Browser Redirection: If a user opens the link in a browser other than Safari—the default on Apple devices—a deceptive "Browser Restricted" landing page prompts them to switch to Safari, which the exploit relies upon for successful infiltration.
- Target Vulnerabilities: The campaign specifically targets iPhones running iOS 18.4 through iOS 18.6.2. Devices operating outside this window, or those updated to newer software, remain protected. Malwarebytes noted that the exploit code currently contains no entries for iPads or Mac computers.
The Data Harvested by the Payload
Once the DarkSword payload successfully bypasses a device’s security protections, it initiates a broad sweep of the iPhone’s internal data directories. The stolen information includes:
- Account passwords and credentials
- Private messages and call histories
- Contact lists and voicemails
- Personal emails and photo libraries
- Application-specific data and Apple Notes
- Cryptocurrency wallet recovery data and credentials
Chronology of the Scam: From Click to Compromise
Understanding how the attack unfolds highlights the speed and efficiency with which modern mobile exploits operate.
- The Trap is Set: A user encounters a malicious social media post, text message, or web ad advertising a $500 preorder discount for the iPhone Duo.
- The Landing Page Loads: Upon visiting the URL, the DarkSword exploit immediately begins executing in the background of the user’s Safari browser.
- The Interactive Illusion: To maintain the illusion of legitimacy, the page features a "Claim $500 Voucher" button. Clicking this leads to a product configuration form.
- Telltale Discrepancies: Sharp-eyed users might notice inconsistencies on the form. For instance, the finish color menu lists "natural titanium"—a shade not offered for the iPhone Duo, which exclusively comes in star white and night sky. Furthermore, the size options listed are 6.3 and 6.9 inches, whereas the actual foldable device measures 7.6 inches unfolded and 5.4 inches folded.
- The False Confirmation: Submitting the form yields a reassuring "Pre-Order Successful" message. By the time this message appears, however, the background data theft is already well underway.
Supporting Data and Technical Insights
The rapid evolution of mobile exploits underscores a shifting battlefield in cybersecurity. Malware research engineers emphasize that mobile web browsers have become primary vectors for sophisticated nation-state-grade and commercial exploit tools.
- Target Software Scope: Malwarebytes confirmed that the exploit script targets a precise window of iOS versions (18.4 to 18.6.2). Older operating systems lacking the latest patches are prime targets because they contain unresolved memory-corruption vulnerabilities that the DarkSword chain leverages.
- The Rise of Mobile Cryptotheft: Security firms report a 40% year-over-year increase in mobile-targeted malware designed specifically to hunt for cryptocurrency seed phrases, exchange cookies, and hardware wallet connection tokens. Because many users manage decentralized finance (DeFi) portfolios directly from their smartphones, mobile endpoints have become high-value targets.
Official Responses and Expert Commentary
Tech industry leaders and security researchers alike are urging consumers to adopt a proactive stance toward device hygiene and software updates.
Stefan Dasic, a senior malware research engineer at Malwarebytes, offered a stark analogy regarding the importance of keeping operating systems up to date in an interview with CNET:
"We live in a time where staying safe means keeping up with technology. Skipping a security update is like being handed a free replacement for a front-door lock that burglars already know how to pick, and leaving it in the box."
Apple’s Security Guidance
Apple maintains that devices running contemporary software—ranging from iOS 15 through the latest iterations of iOS 26 (with iOS 27 on the horizon)—are immune to the specific DarkSword exploit chain utilized in this campaign.
To verify device security, users are instructed to navigate to:
Settings > General > Software Update
Apple strongly recommends installing the most recent available software update and enabling Automatic Updates to ensure that critical zero-day patches are applied immediately upon release. Furthermore, consumers interested in purchasing the iPhone Duo should restrict their inquiries exclusively to Apple’s official website, certified Apple Stores, or authorized retail partners such as Best Buy and major cellular carriers.
Implications and Actionable Steps for Victims
The implications of the DarkSword campaign extend far beyond the inconvenience of a compromised handset. Because the exploit targets sensitive personal archives, a successful breach can result in identity theft, unauthorized financial transactions, and the permanent loss of digital assets.
What to Do If You Accidentally Clicked
If you suspect you visited the malicious preorder page or fell victim to the scam, swift and decisive action can mitigate further damage:
- Update and Restart Immediately: Update your iPhone to the latest available iOS version, then perform a complete restart of the device. Malwarebytes notes that the active data-stealing payload does not persist in memory after a system reboot (though data stolen prior to the reboot cannot be recovered).
- Secure Cryptocurrency Assets: If you maintain a cryptocurrency wallet on your mobile device, immediately generate a completely new wallet with a fresh recovery phrase on a secure, uncompromised device. Transfer any remaining funds to the new wallet instantly. If you utilize centralized crypto exchanges, secure those accounts with updated credentials and notify customer support.
- Change Compromised Passwords: Using a trusted, separate device, immediately change the passwords for your primary email accounts, Apple ID, banking portals, and investment accounts.
- Enforce Multi-Factor Authentication (MFA): Upgrade your account security by enabling robust multi-factor authentication, preferably using hardware security keys or authenticator apps rather than SMS-based verification codes, which remain vulnerable to SIM-swapping attacks.
- Utilize Security Suites: Security tools such as Malwarebytes’ Scam Guard and Browser Guard can proactively identify suspicious screenshots, block malicious redirects, and prevent fraudulent web pages from rendering within mobile browsers.
As the official launch of the iPhone Duo approaches, consumer vigilance remains the ultimate line of defense against increasingly sophisticated cybercriminal enterprises.
