{
  "id": 10952690,
  "title": "Fake iPhone Duo preorder page can steal crypto wallet data and more",
  "url": "https://urgent.news/2026/09/30/fake-iphone-duo-preorder-page-can-steal-crypto-wallet-data-and-more",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-09-30T13:33:34.000Z",
  "source": {
    "name": "9to5Mac",
    "slug": "9to5mac",
    "url": "https://9to5mac.com/2026/09/30/fake-iphone-duo-preorder-page-can-steal-crypto-wallet-data-and-more/"
  },
  "original_language": "en",
  "account": "Fake iPhone Duo preorder page can steal crypto wallet data and more\n\nA fraudulent website mimicking the real iPhone Duo pre-order page is being used to steal data from unsuspecting victims. Security researchers have identified the page as using the DarkSword exploit chain, which targets older iPhones that have not been patched. The site offers a $500 discount voucher as an \"Authorized Partner Exclusive\" to lure potential victims.\n\nOnce a visitor lands on the page, the attack commences without any action required from the user. The malicious payload attempts to steal saved credentials, cryptocurrency wallet data, and notes from the device. It captures device identifier information, status, installed apps, and the contents of Apple Notes.\n\nThe code also scans for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. If it identifies a targeted wallet, the malware attempts to recover saved credentials from the phone's keychain. If successful, it uploads wallet files, recovered keychain data, and photo thumbnails to the attacker's server.\n\nBeyond stealing crypto wallet data, the payload aims to access various aspects of the user's device, including messages, contacts, call history, voicemail, email, calendar entries, and cached location data. The exploit chain was disclosed by Google in March, and Apple released a patch the same month. Users should avoid clicking on suspicious links, keep their iOS devices updated, and monitor their accounts for any unusual activity.",
  "summary": "iPhone Duo pre-orders start on Friday, October 16 , but scammers are trying to trick people into visiting a fake website to place their order now. The website with the malware convincingly replicates the look of the real thing and claims to offer a $500 discount voucher as an “Authorized Partner Exclusive” … more…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}