[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 11 sources · 4 days · First seen · Last updated

iPhone Duo phishing and DarkSword exploit scam

Overview

Cybersecurity experts have identified a sophisticated phishing campaign targeting users through fraudulent preorder pages for the Apple iPhone Duo and iPhone 18 Pro. The scam utilizes fraudulent websites that mimic official Apple designs, often luring victims with offers such as fake $500 vouchers or AppleCare+ coverage.

Technical analysis indicates the attack can leverage the leaked ‘DarkSword’ iOS exploit chain. This allows attackers to compromise a device simply by a user visiting a malicious webpage in Safari, requiring no further interaction or downloads. Once a device is accessed, the malicious site checks the software version and attempts to exfiltrate sensitive data, including keychain credentials, Apple Notes, messages, contacts, and files from various cryptocurrency wallets such as MetaMask, Phantom, and Coinbase Wallet.

Entities

Apple · Kaspersky · Darksword · Malwarebytes · Safari

Timeline

  1. [TECHNOLOGY] 8 sources
    Cybersecurity alert issued for iPhone Duo pre-sale scam

    Malwarebytes Labs warns of a phishing scam using fake Apple websites to steal data from users interested in the iPhone Duo and iPhone 18 Pro pre-sales.

  2. [TECHNOLOGY] 3 sources
    iPhone Duo scam uses DarkSword exploit to target users

    A fraudulent iPhone Duo preorder page is using the DarkSword iOS exploit to target iPhones, stealing sensitive data and cryptocurrency wallet files with zero user interaction required.

Sources

20minutos.es · applesfera.com · enter.co · infoarenales.com · m.businesstoday.in · merca20.com · movilzona.es · netthings.pt · newsonline.com.ar · sdpnoticias.com · technadu.com