Scammers have weaponized fake iPhone Duo preorder pages to deploy the DarkSword exploit chain targeting vulnerable iPhones. The attack is triggered simply by opening the malicious page in Safari, requiring no user interaction. It exploits unpatched iOS vulnerabilities disclosed by Google in March 2026 and patched by Apple. The payload steals saved credentials, cryptocurrency wallet data, notes, messages, contacts, and other sensitive information. It establishes communication with command-and-control servers and can execute additional commands remotely while attempting to cover its tracks by deleting diagnostic reports.

The attack can lead to theft of sensitive user data including saved credentials, cryptocurrency wallet information, personal notes, messages, and contacts. It enables remote command execution by attackers and attempts to evade detection by deleting diagnostic reports. This compromises user privacy and security on affected iPhones running unpatched iOS versions.

Apple has patched the vulnerabilities exploited by the DarkSword attack in updates released after the March 2026 disclosures by Google. Users should ensure their iPhones are updated to the latest iOS version to protect against this exploit. Avoid visiting suspicious or untrusted preorder pages, especially those claiming unrealistic offers. No additional vendor advisory was provided, so check Apple's official security updates for confirmation.