20:11Machine-translated from Azerbaijani by AIRead in Azerbaijani
Fake folding iPhone Duo website attacks iPhones as soon as it is opened
Preorders for the “iPhone Duo” will begin on Friday, October 16. However, scammers are already trying to deceive users with a fake website. Apple’s first foldable phone will go on sale in stores on October 23. The fake page promises a 500 dollar (850 manat) discount under the guise of an “authorized partner offer.”
The website looks convincing because the page uses the Apple logo, the company’s font and a similar writing style. There is even a copyright notice at the bottom. However, the links to the privacy, terms of use and sales policy sections do not work. The order form lists a nonexistent natural titanium color, as well as 6.3-inch and 6.9-inch sizes. The “iPhone Duo” comes in star white and night sky colors. The screen measures 7.6 inches when open and 5.4 inches when folded. Submitting the form displays a successful preorder message, but the data theft process may begin as soon as the page is opened. The attack exploits a chain of security vulnerabilities called “DarkSword.” It targets older “iPhone” models running versions from iOS 18.4 through 18.6.2 that have not received the security update. The attack begins as soon as the page is opened. The user does not need to enter information, tap a button or download a file. If another browser is selected, the website redirects the user to “Safari.” No references to attacks on “iPad” or “Mac” were found in the malicious code. “Google” disclosed these vulnerabilities in March, and “Apple” released a fix that same month.
If the attack succeeds, the malicious code attempts to send information identifying the device, its status, a list of applications and “Apple Notes” notes to a server. It searches for “MetaMask,” “Phantom,” “Trust Wallet,” “Coinbase Wallet,” “Exodus” and “Tonkeeper” cryptocurrency wallets, as well as saved login information. Wallet files, small photo previews and passwords stored on the phone may be sent to the attacker. Messages, contacts, call history, voicemail, emails, calendar and location data are also at risk. The malware can receive additional commands from the server.
According to “Apple,” devices running the latest versions of systems from iOS 15 through iOS 26 are already protected against this attack. To check for an update, open “General” in “Settings” and select “Software Update.” It is also advisable to keep automatic updates enabled. Preorders should be placed only through Apple’s official store and trusted retailers. Users are advised not to open suspicious links in advertisements and messages. If the fake page has already been opened, the “iPhone” should be updated and restarted immediately. According to the research, the data-stealing code does not return after the phone is restarted. However, data transmitted before then cannot be recovered. If the phone has a cryptocurrency wallet, another wallet should be created with a new recovery phrase and the funds transferred to it. The security of the exchange account should also be checked. Passwords for email, the “Apple” account, banks and other financial services should be changed from a trusted device, and 2-step verification should be enabled.
The website looks convincing because the page uses the Apple logo, the company’s font and a similar writing style. There is even a copyright notice at the bottom. However, the links to the privacy, terms of use and sales policy sections do not work. The order form lists a nonexistent natural titanium color, as well as 6.3-inch and 6.9-inch sizes. The “iPhone Duo” comes in star white and night sky colors. The screen measures 7.6 inches when open and 5.4 inches when folded. Submitting the form displays a successful preorder message, but the data theft process may begin as soon as the page is opened. The attack exploits a chain of security vulnerabilities called “DarkSword.” It targets older “iPhone” models running versions from iOS 18.4 through 18.6.2 that have not received the security update. The attack begins as soon as the page is opened. The user does not need to enter information, tap a button or download a file. If another browser is selected, the website redirects the user to “Safari.” No references to attacks on “iPad” or “Mac” were found in the malicious code. “Google” disclosed these vulnerabilities in March, and “Apple” released a fix that same month. If the attack succeeds, the malicious code attempts to send information identifying the device, its status, a list of applications and “Apple Notes” notes to a server. It searches for “MetaMask,” “Phantom,” “Trust Wallet,” “Coinbase Wallet,” “Exodus” and “Tonkeeper” cryptocurrency wallets, as well as saved login information. Wallet files, small photo previews and passwords stored on the phone may be sent to the attacker. Messages, contacts, call history, voicemail, emails, calendar and location data are also at risk. The malware can receive additional commands from the server. According to “Apple,” devices running the latest versions of systems from iOS 15 through iOS 26 are already protected against this attack. To check for an update, open “General” in “Settings” and select “Software Update.” It is also advisable to keep automatic updates enabled. Preorders should be placed only through Apple’s official store and trusted retailers. Users are advised not to open suspicious links in advertisements and messages. If the fake page has already been opened, the “iPhone” should be updated and restarted immediately. According to the research, the data-stealing code does not return after the phone is restarted. However, data transmitted before then cannot be recovered. If the phone has a cryptocurrency wallet, another wallet should be created with a new recovery phrase and the funds transferred to it. The security of the exchange account should also be checked. Passwords for email, the “Apple” account, banks and other financial services should be changed from a trusted device, and 2-step verification should be enabled.