# iPhone Duo phishing and DarkSword exploit scam

> Live situation record from CLSTR: https://clstr.news/situations/iphone-duo-phishing-and-darksword-exploit-scam
> Updated: 2026-10-02T10:47:31.000Z. Sources: 11. Developments: 2.

Cybersecurity experts have identified a sophisticated phishing campaign targeting users through fraudulent preorder pages for the Apple iPhone Duo and iPhone 18 Pro. The scam utilizes fraudulent websites that mimic official Apple designs, often luring victims with offers such as fake $500 vouchers or AppleCare+ coverage.

Technical analysis indicates the attack can leverage the leaked ‘DarkSword’ iOS exploit chain. This allows attackers to compromise a device simply by a user visiting a malicious webpage in Safari, requiring no further interaction or downloads. Once a device is accessed, the malicious site checks the software version and attempts to exfiltrate sensitive data, including keychain credentials, Apple Notes, messages, contacts, and files from various cryptocurrency wallets such as MetaMask, Phantom, and Coinbase Wallet.

## Timeline

### 2026-10-02: Cybersecurity alert issued for iPhone Duo pre-sale scam

Malwarebytes Labs warns of a phishing scam using fake Apple websites to steal data from users interested in the iPhone Duo and iPhone 18 Pro pre-sales.

8 sources. https://clstr.news/cluster/cybersecurity-alert-issued-for-iphone-duo-pre-sale-scam

### 2026-09-28: iPhone Duo scam uses DarkSword exploit to target users

A fraudulent iPhone Duo preorder page is using the DarkSword iOS exploit to target iPhones, stealing sensitive data and cryptocurrency wallet files with zero user interaction required.

3 sources. https://clstr.news/cluster/iphone-duo-scam-uses-darksword-exploit-to-target-crypto-wallets

---
Cite as: iPhone Duo phishing and DarkSword exploit scam. CLSTR, https://clstr.news/situations/iphone-duo-phishing-and-darksword-exploit-scam