SecurityHeroblog
Security Basics10views

The iPhone Duo Preorder Hasn't Opened Yet — What the Page That Arrived First Really Is

Apple's official preorder opens on October 16. Ahead of that, a fake preorder page dangling a '$500 coupon' has been found. According to the analysis, on an iPhone that has put off updating, merely opening this page starts the attack.

The doorbell rings

The doorbell rings in the evening. Someone outside the door says, “It’s a preorder event for the new product. Sign up now and you get a $500 coupon.”

A cautious person doesn’t throw the door wide open. They open it just a hand’s width, with the chain lock still fastened. You can take the flyer and close the door. Usually that’s enough.

But if that chain lock is a model the manufacturer has already announced a defect in, the story changes. Someone carrying the tool that matches that defect can undo the chain through a hand’s-width gap. While I’m writing my name on the entry slip, the hand outside the door is working on the chain.

The story that came out of the security industry this week is exactly this scene. Except the front door is my iPhone. The doorbell is a link to a web page.

What is happening

FACT The security firm Malwarebytes found an “iPhone Duo preorder” page that mimicked Apple’s design. It published an analysis on September 29. Inside this page was iPhone attack code called DarkSword.

FACT The page works like this.

  • It dangles a $500 coupon and AppleCare included. AppleCare is Apple’s repair warranty service.
  • If you open it in a browser other than Safari, it tells you “Please open this in Safari.”
  • There are fields for name, email, and phone number.
  • Once you fill them all in, a “reservation complete” screen appears. But no actual order is placed.

FACT The real attack does not happen in those input fields. On a vulnerable iPhone, the attack attempt begins merely by opening the page. You don’t have to fill in the fields. You don’t have to download anything.

INFERRED Translated back into the front-door analogy: the field where you write your name is the entry slip. It’s a prop that holds my eyes. The real work happens in the gap, the moment the door is opened a hand’s width.

FACT Malwarebytes also analyzed what the attack tries to take if it succeeds. The list below is what was reported in that analysis. It has not been confirmed to the point of observing data actually leaving a real iPhone.

  • Passwords stored in the Keychain. The Keychain is the vault where the iPhone remembers passwords on my behalf.
  • Apple Notes
  • Messages, call history, contacts, voicemail, mail, calendar
  • Location history
  • List of installed apps
  • Data from six crypto wallet apps — MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, Tonkeeper

FACT Even if you are infected, there may be no sign of it on screen. Once the door is closed, the chain lock looks fine. That holds even after it has already been undone once and refastened.

Why this bait works

FACT The official iPhone Duo preorder date announced by Apple is October 16. The release is October 23. Korea is among the first-wave launch countries.

INFERRED So we think right now is when this bait works best. There are three reasons.

First, the waiting. There are about two weeks left from today (October 3) until the official preorder. To someone who is waiting, “you can reserve early” is tempting. It’s as if the doorbell rang at a house that had been waiting for the doorbell.

Second, the big discount. A $500 coupon is not a discount official sellers give. The flashier the flyer, the more reason there is to open the door and look.

Third, “Please open this in Safari.” This attack code works when the page is opened in Safari. If the person outside insists “please open this particular door,” it means they came carrying the tool that fits that door’s chain. It looks like a helpful instruction, but it is actually the step that sets up the attack conditions.

By the numbers

FACT There aren’t many confirmed numbers in this case. Still, each one connects to something you should do.

Number What it is For comparison
$500 The coupon amount on the fake page Official sellers do not give discounts like this. The amount itself is a warning sign
October 16 The start date of Apple’s official preorder If anything says “reserve now” before this date, it’s fake
6 iPhone weaknesses used one after another in the span of opening a single page It looks like a lot, but a single update blocks them all
6 apps Crypto wallet apps the attack code targets If you use these apps, the damage turns straight into money

FACT DarkSword is not a new weapon. Google’s threat analysis team (GTIG) disclosed it in March 2026. It is an attack bundle that chains together six iPhone weaknesses — that is, vulnerabilities — in sequence. To undo one chain lock you have to pass through several weaknesses in order, and you can think of this as a toolkit that has already stitched that whole sequence together in advance.

FACT Three of those six were zero-days at the time of disclosure. A zero-day is a weakness the manufacturer did not yet know about, so there was not a single replacement part to fix it with.

FACT By Google’s analysis, the affected versions are iOS 18.4–18.7. All of them are fixed in iOS 26.3 and later. Some were fixed earlier than that, in iOS 18.7.2–18.7.3. Malwarebytes reported that Apple stated “updated devices are protected from the reported DarkSword attacks.”

INFERRED To sum up: the chain lock’s defect was already known half a year ago. The manufacturer has also put out a new chain. What this page is after is the houses that haven’t swapped the chain yet.

FACT At the time of its March disclosure, DarkSword was reported to have been used by commercial surveillance vendors and by several organizations suspected of being state-backed. Who runs this fake page, and whether they have any relationship to those actors, has not been confirmed. The actual number of victims has not been released either. So we won’t attach a number to it.

What to do now

There are two main things to do. Swap the chain, and don’t answer the doorbell.

1. Swap the chain first — update iOS

  • Go to Settings > General > Software Update and move up to the latest iOS.
  • On the same screen, turn on Automatic Updates. This way the chain gets swapped on its own when the next defect becomes known.
  • If you have ever opened a suspicious preorder page, turn your iPhone off and back on once.

FACT There is a basis for recommending a restart. Malwarebytes stated that it saw no mechanism in the analyzed code for reviving itself after a reboot. That said, this too is a reported analysis, not the result of testing on a real device.

FACT If circumstances keep you from moving up to the latest version, Google recommended turning on Apple’s Lockdown Mode. Think of it as a setting that raises the iPhone’s door-locking to its highest level.

2. Don’t answer the doorbell — go there yourself

  • For preorders, don’t tap a link. Type apple.com into the address bar yourself.
  • Or do it only in the Apple Store app or a carrier’s official app.

In front-door terms, this is walking to the store yourself instead of dealing with the person outside the door. Then no matter who came with what tool, there’s no way for my door to open.

Close the door if you see any of this

  • “Reserve now” before October 16
  • “$500 coupon, official partners only”
  • Colors or model options Apple doesn’t sell
  • “This browser is restricted, please open in Safari” in another browser like Chrome

If you already opened it and you have a crypto wallet

  • Create a new wallet and a new recovery phrase and move your assets. The recovery phrase is the key sentence that restores an entire wallet.

INFERRED An update blocks the gaps that could open from here on. But it can’t take back what may have already gotten out. No way for you to check on your own whether you were infected has been published either. So for a wallet with money on the line, making the key itself anew is the safer side.

What We Don’t Know

These are the things this post could not confirm. We write them out separately so we don’t pretend to know.

  • We don’t know what route it spreads through. Malwarebytes only said it could arrive via ads, messages, or social media posts. There is no material on the actual distribution route. There is also no basis for declaring “it comes by text message.”
  • We don’t know how many victims there are. No number has been released.
  • We don’t know exactly which iOS versions this page targets. Malwarebytes stated it could not confirm this either. It wrote itself that it neither tested on a real iPhone nor observed data going out. The “iOS 18.4–18.7” above is the range for DarkSword as a whole, from Google’s March analysis.
  • We don’t know whether a Korean-language page exists, or whether it is spreading in Korea. There is no such reporting. All we can say is that the timing overlaps, because Korea is a first-wave launch country.
  • We don’t know whether older iPhones that can’t move up to iOS 26 are fully protected by an iOS 18 update alone. 9to5Mac wrote in March that a patch for iOS 18 had been released. Google wrote that only some were fixed earlier in 18.7.2–18.7.3 and that the complete fix is 26.3. We were not able to cross-check the two.
  • We don’t know who operates the page. Nothing is known about whether they have any relationship to the organizations that used DarkSword in March. We do not speculate about nationality or who is behind it.
  • No method has been reported for someone who opened the page to check on their own whether they were infected.
  • We were not able to open and cross-check Apple’s original security advisory directly.

Sources

Primary sources

Coverage

Related CVEs (published vulnerability IDs): CVE-2025-31277 · CVE-2025-43529 · CVE-2026-20700 · CVE-2025-14174 · CVE-2025-43510 · CVE-2025-43520

Compiled as of 2026-10-03. This is not something observed in our honeypot. It is a retelling, in our own words, of the public analyses in the sources above. Article sentences and images were not reproduced. This post does not include attack code, malicious addresses, or credentials. Not confirmed: the list of data the attack code targets and the claim that it “does not revive after a reboot” rest solely on Malwarebytes’ reported analysis. They have not been confirmed on a real iPhone, and the distribution route and the scale of damage have not been released either.