GoKawiilFake iPhone Duo preorder site exploits unpatched iPhones to steal crypto wallets
Ahead of Friday's official iPhone Duo preorder launch, a fraudulent website mimicking Apple's design and offering a fake $500 discount is using the leaked DarkSword exploit chain to attack vulnerable, unpatched iPhones. Malwarebytes researchers say simply visiting the page can trigger an attack that harvests device data, notes, keychain credentials and cryptocurrency wallet files from apps like MetaMask, Phantom and Coinbase Wallet, then exfiltrates them to a remote server.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the exploit requires no clicks beyond loading the page, it poses risk to anyone lured to the site by preorder hype, particularly those who haven't installed Apple's March patch for the vulnerability. The targeting of multiple major crypto wallets suggests attackers are prioritizing financial theft, and the ability to pull contacts, messages and location data indicates broader surveillance potential beyond just funds.
- A fake iPhone Duo preorder site uses the DarkSword exploit chain to attack unpatched iPhones on visit alone.
- The malware targets crypto wallets including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper, plus keychain credentials.
- Apple patched the underlying vulnerability in March after Google disclosed it, so updating iOS mitigates the threat.
Malwarebytes Premium Security Software — Since this scam relies on exploiting unpatched devices to steal credentials and crypto wallet data, having real-time malicious website blocking is a smart defense. Malwarebytes Premium actively flags phishing and exploit-laden pages like the fake iPhone Duo site before they can load, adding a layer of protection beyond just keeping your OS updated. It's a practical safeguard for anyone worried about drive-by attacks targeting sensitive wallet and note data.
See Malwarebytes Premium Security Software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 9to5mac.com — Ben Lovejoy, 2026-09-30
Published there as: “Fake iPhone Duo preorder page can steal crypto wallet data and more”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.