Overview
- Malwarebytes researchers found a convincing fake iPhone Duo pre-order webpage on Sept. 30 that uses the DarkSword exploit chain to run code when an unpatched iPhone simply opens the page.
- The malicious code forces or ensures Safari is used and then tries to bypass iOS protections so a follow-on payload can collect device identifiers, a list of installed apps, and the contents of Apple Notes.
- The payload specifically searches for popular crypto wallets including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus and Tonkeeper and will attempt to exfiltrate wallet files, recovered keychain credentials, and photo thumbnails if connections to its server succeed.
- Devices running iOS 26 or the latest iOS 18 builds should be protected because Apple patched the DarkSword chain in March 2026, so the immediate defense is installing Apple’s updates and avoiding unsolicited pre-order links.
- The incident follows earlier leaks of DarkSword code and rising wallet-targeting scams, which together raise the risk for users who delay updates and underline potential real losses of funds and private data if attackers succeed.