iPhone pre-order scams usually try to steal credit card numbers through deceptive forms, but a new campaign designed to milk the hype around the iPhone Duo is taking a much more aggressive approach. Malwarebytes has uncovered a fake Apple website that offers a bogus $500 voucher to distract visitors, while quietly running background code to hijack older iPhones. Opening the link reportedly triggers an attack that tries to breach unpatched iPhones without requiring a single tap or download.
A zero-click threat disguised as a deal
Most pre-order scams rely on social engineering to trick you into entering personal details or payment information, but this fake Apple site operates differently. It mimics Apple’s official website design down to the footer copyright, but the incorrect model sizes, unannounced colors, and a countdown timer that resets every time the page reloads give away that the store is fraudulent. The pre-order form asks for contact details while promising an exclusive $500 voucher and AppleCare+ coverage, yet submitting it doesn’t actually send anything to a server.
Instead, the site uses the pre-order form as a simple distraction while launching a zero-click attack in the background. An invisible frame inspects your browser version and attempts to steer you into Safari to run the DarkSword exploit chain against older versions of iOS.
If the attack breaks through, a hidden payload harvests stored keychain passwords, Apple Notes contents, call logs, contacts, photos, and cryptocurrency wallet files from apps like MetaMask and Coinbase Wallet.
Keeping unpatched iPhones safe from background attacks
This campaign relies on target psychology because shoppers eyeing new hardware might still be using older, unpatched phones. Apple patched the underlying DarkSword vulnerabilities in recent iOS updates, but anyone browsing on outdated software remains exposed the moment they land on the website.
To protect yourself from scams like these, make sure you’re running the latest iOS release. You should also navigate to official store channels directly instead of following pre-order links in unsolicited messages or ads. If you accidentally opened the malicious link, restart your device to clear the running payload from system memory, update your operating system, and secure your key accounts and crypto wallets from a clean device.
