Fake iPhone Duo Preorder Page Uses DarkSword to Target Vulnerable iPhones
Summary
A fake iPhone Duo preorder page attempts to exploit vulnerable iPhones through the DarkSword chain and steal sensitive data. Researchers analyzed the code but did not test it on an iPhone or observe data being sent.
Key points
- Opening the page in Safari can start the exploit attempt without a tap, form submission, or download.
- The lure promises a $500 voucher and uses a fake preorder form; the captured version generates a success message but does not send the entered details.
- If the exploit succeeds, the payload attempts to access credentials, cryptocurrency wallet data, Apple Notes, and other files and personal information.
- The payload can communicate with a server for further instructions and attempts to delete diagnostic reports.
- Researchers did not test the code on an iPhone or observe data leaving a device; the page’s exact range of vulnerable iOS versions is unconfirmed.
- Apple says updated devices are protected against the reported DarkSword attacks. The article recommends updating iOS and restarting the phone if the page was opened.
Article Details
- Attack Vectors
- A fake iPhone preorder page initiates the DarkSword exploit attempt when opened, without requiring a form submission or other user interaction.
- The page attempts to steer iPhone visitors to Safari, which the exploit chain targets.
- If the exploit succeeds, a payload attempts to collect device information, installed apps, Apple Notes, files, photos, messages, contacts, and saved credentials, and to upload selected data to its server.
- Defensive Notes
- Keep iOS updated and enable Automatic Updates; Apple says updated devices are protected against the reported DarkSword attacks.
- Avoid opening unfamiliar preorder links; navigate directly to Apple or a known retailer.
- If the page was opened, update and restart the iPhone. Restarting cannot undo data already taken.
- If a wallet may have been exposed, create a new wallet with a new recovery phrase on a trusted device and move the funds. Secure affected exchange accounts and contact the exchange.
- Change potentially exposed passwords from a trusted device and enable two-factor authentication.
- Report the page and preserve its URL and screenshots without reopening it.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloud[.]cmatgldn[.]click | Ad click and conversion tracker associated with the scam page. |
| DOMAIN | pnmrud[.]cc | Command-and-control and collection server for the payload. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload attempts to collect local device data, including files, notes, photos, and saved credentials.T1041 · Exfiltration Over C2 ChannelAfter successful exploitation, the payload attempts to upload wallet files, recovered keychain data, and photo thumbnails to its server.T1059.007 · JavaScriptThe payload can run JavaScript supplied by its server.T1189 · Drive-by CompromiseOpening the fake preorder page starts the exploit attempt without further user interaction.
Vendors
Products
Apple NotesIt also attempts to send a list of installed apps and the contents of Apple Notes.Browser GuardOn desktop, Browser Guard blocks the fake preorder page we analyzed; web protection in Malwarebytes Premium blocks it too.Coinbase WalletThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.ExodusThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.iOSAn invisible frame checks the visitor’s iOS version and selects the next code to load.iPhoneApple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it.Malwarebytes PremiumOn desktop, Browser Guard blocks the fake preorder page we analyzed; web protection in Malwarebytes Premium blocks it too.MetaMaskThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.PhantomThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.SafariVisitors using browsers the script doesn’t recognize as Safari see a “Browser Restricted” notice.Scam GuardScam Guard can give a verdict on a screenshot or link.TonkeeperThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.Trust WalletThe code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper.