Fake iPhone Duo Preorder Site Spreads Malware

A malicious website has been discovered that mimics Apple's official iPhone Duo preorder page. The fake site, which claims to offer a $500 discount voucher as an 'Authorized Partner Exclusive,' uses the DarkSword exploit chain to attempt to break into vulnerable iPhones. This malware can steal device identifier information and status, as well as capture a list of installed apps and the contents of Apple Notes.

The malicious code also targets cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. If it finds a targeted wallet, it attempts to upload wallet files, recovered keychain data, and photo thumbnails. The exploit can access messages, contacts, call history, voicemail, email, calendar entries, and cached location data.

Users are advised to never visit links sent to them unless they trust the sender and are specifically expecting them. They should also ensure that they install iOS updates as soon as they are available. Apple issued a patch for the DarkSword exploit chain in March of this year.