Fake iPhone Duo preorder scam triggers DarkSword attack

Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain against vulnerable iPhones. The fraudulent pages mimic Apple's design and offer a $500 voucher to lure victims, but simply opening the page in Safari triggers an exploitation attempt without requiring user interaction. The attack targets iPhones running unpatched iOS versions, attempting to bypass security protections and deploy a payload designed to steal saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. The exploit leverages vulnerabilities previously disclosed by Google in March 2026 and patched by Apple. If successful, the payload establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.

• Stolen webcam clips of 900+ victims feed North Korea's $400 million fake Zoom schemeCampaign2026-11-13
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Luna Moth Returns, Re-Targeting Law Firms Through Access TokensCampaign2026-11-12
• 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RATMalware2026-11-13