Scammers are using iPhone Duo pre-orders to try and steal your passwords — here's how to stay safe

The Threat of Fake iPhone Duo Pre-Orders

As excitement builds around Apple's upcoming device releases, cybercriminals are wasting no time exploiting consumer eagerness. Security researchers at Malwarebytes have uncovered a sophisticated scam targeting prospective buyers with bogus advertisements promising early access and heavy discounts on the unreleased iPhone Duo.

With official pre-orders not scheduled to open until October 16, any ad claiming you can secure the foldable device right now—especially with a massive $500 discount off its expected $2,000 price tag—should be treated as an immediate red flag.

How the DarkSword Exploit Works

Unlike standard phishing scams that merely trick users into typing their credentials into a fake form, this campaign weaponizes a leaked DarkSword exploit chain. According to Malwarebytes, vulnerable iPhones running iOS 18.4 through iOS 18.6.2 can be compromised simply by visiting the malicious webpage. Users do not need to click download links or interact with the page for the exploit to execute.

Once triggered, the malicious code attempts to harvest sensitive data, including saved passwords, secure notes, and cryptocurrency wallet information. Furthermore, the fake pre-order pages closely mimic Apple’s official aesthetic—utilizing authentic branding, fonts, and layout styles—making them dangerously convincing, despite containing factual errors such as referencing non-existent color options or incorrect screen sizes.

Steps to Stay Safe and Protect Your Device

To safeguard your personal information and prevent falling victim to this sophisticated scam, security experts recommend taking immediate preventative actions:

• Update Your Software: Ensure your iPhone is running the latest version of iOS. Apple has released patches addressing vulnerabilities like the DarkSword exploit chain, making updating essential for device security.
• Verify Official Channels: Only pre-order Apple devices through authorized retailers, such as the official Apple Store, major carriers, or trusted partners like Walmart and Best Buy. Apple rarely offers steep discounts on newly launched products at the start of their lifecycle.
• Exercise Caution with Links: Avoid clicking on unsolicited ads or social media links promising too-good-to-be-true deals or early device availability.
• Mitigate Risks If Clicked: If you believe you visited a suspicious page, restart your device immediately and update your software. If you suspect data exposure, manually change important passwords and secure your digital assets.