The lookalike storefront convincingly mimics Apple's official design and dangles a $500 "Authorized Partner Exclusive" discount voucher, even though genuine pre-orders for Apple's foldable iPhone Duo do not open until Friday, October 16. Visitors are urged to place their orders early through a pre-order form asking for a name, email address, and phone number.
A $500 voucher that hides a drive-by attack
Behind the Apple-style design and a countdown timer, the page runs the leaked DarkSword exploit chain in a hidden frame. Malwarebytes says the code first checks the visitor's iOS version and steers iPhone users into Safari, the browser the exploit targets. Submitting the form is meaningless — researchers found it returns a "Pre-Order Successful" message without processing anything entered. The exploit attempt begins without any clicks, downloads, or form submissions: simply opening the page is enough.
DarkSword was first disclosed by Google's researchers back in March 2026, and Apple issued a patch the same month. But a newer version of the chain later leaked onto GitHub, putting the code in the hands of anyone who wanted it — and scammers have now weaponized it against Apple's most hyped phone launch in years.
What the payload hunts for
If the exploit succeeds against an unpatched device, the payload starts by grabbing the device's identifier and status, then attempts to send a list of installed apps and the contents of Apple Notes back to the attacker's server.
From there it turns its attention to cryptocurrency wallets — scanning for MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper — while also attempting to recover saved credentials from the iPhone's keychain. Where it finds a target wallet and successfully contacts its server, it tries to upload wallet files, recovered keychain data, and even photo thumbnails, potentially putting funds at risk.
The harvest does not stop at money. Malwarebytes says the payload can also reach into messages, contacts, call history, voicemail, email, calendar entries, and cached location data, and can check back with its server for further instructions.
Patched phones are safe — outdated ones aren't
The good news: because Apple patched DarkSword in March, any iPhone running up-to-date software is fully protected from this attack, regardless of whether the fake page is visited. The risk is concentrated on devices running older, unpatched iOS versions.
Security experts say the defense is simple. Keep iOS updated — Apple has continued shipping fixes, most recently iOS 26.7.1 for another actively exploited flaw. Order only through Apple's website, the Apple Store app, or official carriers, and treat unsolicited "early pre-order" links in texts or emails with suspicion. As Malwarebytes' finding shows, no legitimate retailer is handing out $500 off a phone that isn't even available for pre-order yet.
By Hamza Faisal
