iPhone Duo pre-orders start on Friday, October 16, but scammers are trying to trick people into visiting a fake website to place their order now.

The website with the malware convincingly replicates the look of the real thing and claims to offer a $500 discount voucher as an “Authorized Partner Exclusive” …

Security researchers at Malwarebytes say the page uses the DarkSword exploit chain, which works with some older unpatched iPhones. You don’t have to do anything, just visiting the page is enough for the attack to launch.

Behind its Apple-style design and $500 voucher, the page uses the leaked DarkSword exploit chain to try to break into vulnerable iPhones. If it succeeds, a separate payload attempts to steal saved credentials, cryptocurrency wallet data, and notes. You don’t have to fill in the form, tap a download, or approve anything. Opening the page is enough to start the attempt.

If it succeeds, then it captures your device identifier information and status and attempts to send a list of installed apps and the contents of your Apple Notes. Having done this, it turns its attention to crypto wallets.

The code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. It also attempts to recover saved credentials from the phone’s keychain. If it finds a targeted wallet and the first exchanges with its server succeed, it attempts to upload wallet files, recovered keychain data, and photo thumbnails. Exposure of wallet files or credentials could put funds at risk.

It goes on to try to access messages, contacts, call history, voicemail, email, calendar entries, and cached location data. The payload can also contact its server for further instructions.

The exploit chain was disclosed by Google back in March, with Apple issuing a patch later the same month.

The usual advice applies to protect yourself. Never visit links sent to you unless you trust the sender and are specifically expecting them. Always ensure that you install iOS updates as soon as they are available.

• Dark Cherry charger & color-matched cable for iPhone 18 Pro
• iPhone 18 Pro and iPhone 18 Pro Max cases
• Beats Woven USB-C cables
• Certified refurbished Apple products 15% off at apple.com
• Discounted AirPods Pro 3
• Wireless CarPlay adapter
• 10-year AirTag battery case
• Logitech MX Master 4 for Mac

Screengrab: Malwarebytes

FTC: We use income earning auto affiliate links. More.