Fake iPhone Duo preorder page can steal crypto wallet data and much more

iPhone Duo pre-orders start on Friday, October 16, but scammers are trying to trick people into visiting a fake website to place their order now.

The website with the malware convincingly replicates the look of the real thing and claims to offer a $500 discount voucher as an “Authorized Partner Exclusive” …

Security researchers at Malwarebytes say the page uses the DarkSword exploit chain, which works with some older unpatched iPhones. You don’t have to do anything, just visiting the page is enough for the attack to launch.

Behind its Apple-style design and $500 voucher, the page uses the leaked DarkSword exploit chain to try to break into vulnerable iPhones. If it succeeds, a separate payload attempts to steal saved credentials, cryptocurrency wallet data, and notes. You don’t have to fill in the form, tap a download, or approve anything. Opening the page is enough to start the attempt.

If it succeeds, then it captures your device identifier information and status and attempts to send a list of installed apps and the contents of your Apple Notes. Having done this, it turns its attention to crypto wallets.

The code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. It also attempts to recover saved credentials from the phone’s keychain. If it finds a targeted wallet and the first exchanges with its server succeed, it attempts to upload wallet files, recovered keychain data, and photo thumbnails. Exposure of wallet files or credentials could put funds at risk.