The iPhone Scam That Can Attack Your Phone Before You Click a Thing
A fake Apple preorder website is exposing a troubling new reality in cybersecurity: sometimes, simply visiting the wrong website is enough to put your information at risk.
Imagine receiving a message offering a $500 voucher toward Apple’s newest iPhone. The website looks authentic. The Apple logo is there, the product photographs look convincing, and the offer even includes AppleCare+ coverage.
You open the page to see whether the deal is legitimate.
You haven’t entered your name. You haven’t provided a credit card number. You haven’t downloaded anything.
But if your iPhone is running vulnerable, outdated software, an attack may already be underway.
That’s the alarming discovery detailed in a September 29, 2026, investigation by cybersecurity researchers at Malwarebytes. Their research uncovered a fake iPhone Duo preorder website designed to exploit security vulnerabilities in older versions of Apple’s mobile operating system.
A $500 Discount Concealing a Much More Dangerous Attack
Apple announced its foldable iPhone Duo in September 2026, with official preorders scheduled to begin October 16.
Cybercriminals wasted little time exploiting the excitement surrounding the new device.
Researchers discovered a fraudulent website that closely imitated Apple’s branding and promised an exclusive $500 preorder voucher. Visitors were encouraged to provide their contact information, choose a device, and claim their discount before a countdown timer expired.
Several details revealed the deception. The website advertised product configurations that did not match Apple’s actual offerings. Its countdown restarted whenever the page was refreshed, and important legal and privacy links led nowhere.
Even more revealing, the preorder form examined by Malwarebytes did not actually submit an order. It simply displayed a manufactured confirmation message.
That’s because selling an iPhone wasn’t the attackers’ real objective.
The website was designed to attempt to compromise the visitor’s phone while appearing to process an ordinary preorder.
The Attack Begins Before You Press a Button
Most people understand traditional phishing attacks. A suspicious email directs someone to a fraudulent website, where the victim is persuaded to enter a password, provide payment information, or download malicious software.
This attack works differently.
According to Malwarebytes, the fraudulent preorder website contains code that automatically attempts to launch an exploit chain called DarkSword.
In simple terms, an exploit chain is a sequence of techniques that takes advantage of software vulnerabilities to bypass security protections.
When someone opens the malicious website, hidden code attempts to identify the version of iOS installed on the device and select an appropriate attack method.
If the phone is vulnerable, DarkSword attempts to break through its protections and obtain access that an ordinary website should never have.
The attackers specifically designed the page to steer visitors toward Safari, the browser targeted by the exploit.
No password submission is required. No installation approval is needed. The attempt can begin as the website loads.
Cybersecurity professionals sometimes describe this general category of threat as a drive-by compromise: an attack initiated through exposure to malicious web content rather than through a deliberate software installation.
Importantly, visiting the page does not guarantee a successful compromise. The attack depends on exploitable vulnerabilities being present on the device.
What Could Criminals Steal From Your iPhone?
The potential consequences extend far beyond an unwanted advertisement or fraudulent purchase.
Malwarebytes found that the code deployed after a successful exploitation attempt was designed to collect sensitive information from a compromised device.
Depending on what information was accessible, the targeted data included:
- Saved passwords and credentials: Information stored in the iPhone’s keychain, potentially including access to online accounts.
- Email and messages: Data that could contain confidential conversations, account verification messages, and business communications.
- Contacts and call records: Information about colleagues, customers, business associates, and personal contacts.
- Apple Notes: Notes that might contain financial information, internal business details, or other sensitive records.
- Photographs and files: Images, documents, and other information stored on the device.
- Cryptocurrency wallets: Wallet information and associated credentials that could potentially allow criminals to steal digital assets.
- Location and calendar information: Data capable of revealing personal activities, appointments, and movements.
The malicious code was also designed to communicate with a remote server, retrieve additional instructions, and attempt to erase certain diagnostic records that investigators might otherwise use to identify the intrusion.
There is an important distinction between what malicious code is capable of attempting and what researchers actually observed.
Malwarebytes analyzed the captured code but did not test the attack on an iPhone or directly observe data being stolen from a device during its investigation.
Nevertheless, the capabilities identified in the code illustrate the serious consequences of a successful compromise.
Why This Should Concern Business Owners
It’s tempting to dismiss an iPhone preorder scam as a problem affecting individual consumers.
For businesses, however, the implications are considerably broader.
Consider how extensively smartphones have become integrated into everyday business operations.
Employees use their phones to access Microsoft 365, business email, cloud storage, customer information, financial platforms, messaging applications, and corporate calendars.
Many organizations also allow employees to use personally owned devices for work.
This creates an important security consideration: a personal smartphone can become a pathway to sensitive business information.
Imagine an employee opening a fraudulent retail promotion on an outdated personal iPhone.
If the device were successfully compromised, attackers might obtain information that could help them access workplace accounts, impersonate the employee, or initiate additional phishing attacks against colleagues and customers.
Even when an attacker cannot directly access a business network, stolen credentials and confidential communications can create opportunities for further attacks.
Organizations in healthcare, financial services, manufacturing, agriculture, and professional services all rely on mobile access to important business systems.
For these organizations, mobile device security should be treated as an essential part of the overall cybersecurity strategy, not simply an employee’s personal responsibility.
Are All iPhones Vulnerable?
No. And this distinction is particularly important.
DarkSword was previously documented by Google’s Threat Intelligence Group in March 2026. Researchers identified a sophisticated collection of vulnerabilities that had been used in attacks against certain older versions of iOS.
Apple has since released security updates addressing the reported vulnerabilities.
According to Apple, devices running updated software are protected against the reported attacks.
That means an iPhone receiving and installing its current security updates is in a significantly better position than a device running outdated software.
The greatest concern involves devices that have not been updated, including older phones that employees may continue using long after newer models become available.
The exact range of devices vulnerable to the fraudulent preorder attack has not been fully established. Malwarebytes identified similarities with known DarkSword exploits but cautioned against assuming every older iPhone would necessarily be compromised.
The practical lesson is straightforward: keeping mobile devices updated remains one of the most effective defenses against known vulnerabilities.
Five Steps Every Business Should Take Now
1. Make Mobile Software Updates a Business Priority
Businesses routinely patch computers and servers, but smartphones sometimes receive less attention.
Employees should regularly check for operating system updates by opening Settings > General > Software Update on their iPhones.
Automatic updates should be enabled, and organizations should establish clear expectations for how quickly security updates must be installed.
For company-owned devices, mobile device management solutions can help IT administrators monitor operating system versions and enforce minimum security requirements.
2. Teach Employees That Fraudulent Websites Can Be Dangerous Before They Enter Information
Traditional security awareness training often focuses on avoiding suspicious downloads and refusing to enter credentials on questionable websites.
Those lessons remain important, but employees also need to understand that some attacks can begin simply by opening a malicious page.
Unsolicited promotional links, limited-time offers, and extraordinary discounts deserve scrutiny, even when the website looks professionally designed.
Employees should visit official company websites directly rather than following unexpected links from advertisements, text messages, emails, or social media posts.
3. Protect Business Accounts Beyond the Password
Multifactor authentication provides an important additional layer of protection for corporate accounts, although it does not make a compromised device harmless.
Organizations should use phishing-resistant authentication methods where practical, review unusual sign-in activity, and apply access policies that consider the security and compliance status of the device.
These measures can help reduce the damage caused by stolen credentials or unauthorized account access.
4. Establish Clear Rules for Personal Devices Used at Work
Bring-your-own-device arrangements can improve convenience and productivity, but they also create additional security responsibilities.
Businesses should establish policies covering supported operating systems, mandatory updates, device encryption, screen locks, access to company information, and the reporting of suspected compromises.
Where appropriate, organizations should consider managed applications and methods of separating business data from personal information.
5. Make Reporting Suspicious Activity Easy
Employees sometimes hesitate to report suspicious links because they fear being blamed for making a mistake.
That hesitation can delay the response to a genuine security incident.
Every organization should have a straightforward process for reporting suspicious websites, unexpected security alerts, and potentially compromised devices.
Prompt reporting allows IT professionals to investigate, protect affected accounts, and determine whether additional action is necessary.
What If You’ve Already Opened a Suspicious iPhone Preorder Website?
Opening a suspicious page does not automatically mean your phone has been compromised. However, if the website resembles the fraudulent campaign identified by Malwarebytes, taking precautions is sensible.
- Do not revisit the suspicious website. Preserve the URL or any existing screenshots for your IT or security team without reopening the page.
- Update iOS immediately. Install the latest security updates available for your device.
- Restart the phone after updating. Malwarebytes did not identify an automatic mechanism that would restart the captured malicious payload after a reboot. However, restarting does not reverse data theft or guarantee that every possible compromise has been eliminated.
- Notify your company’s IT support team. If the phone has access to workplace applications, business email, or company files, it should be evaluated as a potential security incident.
- Secure potentially exposed accounts from a trusted device. Change passwords where appropriate, review account activity, and ask IT to revoke suspicious sessions or credentials.
- Consider additional investigation. If there are indications of compromise, a qualified security professional can assess the risk and recommend further remediation.
If financial or cryptocurrency accounts may have been exposed, take additional precautions with the relevant financial institution or service provider.
The Bigger Cybersecurity Lesson: Trusting What You See Is No Longer Enough
The fake iPhone Duo preorder campaign illustrates how much modern cybercrime has evolved.
Attackers no longer need to rely exclusively on obvious spelling mistakes, poorly designed websites, or convincing someone to download an attachment.
They can imitate legitimate brands, take advantage of major product announcements, and combine familiar social engineering tactics with sophisticated technical exploits.
The $500 voucher was simply the attraction. The real danger was hidden beneath the website’s appearance.
For business owners, the lesson goes beyond Apple, smartphones, or a single fraudulent promotion.
Cybersecurity cannot depend entirely on employees recognizing a scam before it reaches them.
Security awareness is essential, but it must be supported by updated software, appropriate access controls, device management, monitoring, and an effective incident response plan.
A convincing fraudulent website should not have the opportunity to become a company-wide security incident simply because one employee opened a link on an outdated phone.
Protecting Your Business Starts With the Devices Your Employees Use Every Day
At Alvarez Technology Group, we help businesses take a proactive approach to cybersecurity through managed IT services, security monitoring, employee awareness training, and practical strategies for protecting business information.
Whether your organization uses company-owned smartphones, allows employees to work from personal devices, or relies heavily on cloud-based applications, every connected device deserves appropriate security attention.
Now is a good time to ask a few important questions:
- Are the smartphones accessing our business systems running current security updates?
- Do we know which personal devices can access sensitive company information?
- Can we quickly disable business access if a device becomes compromised?
- Do employees know how to report a suspicious website or security incident?
- Would we recognize unusual activity involving a compromised employee account?
If you’re uncertain about the answers, Alvarez Technology Group can help you evaluate your organization’s security practices and identify opportunities to strengthen protection.
Contact Alvarez Technology Group at www.alvareztg.com or call (831) 753-7677 to discuss your business cybersecurity needs.
Sources and additional reading:
Malwarebytes Threat Intelligence: Fake iPhone Duo Preorder Scam Triggers DarkSword Attack (September 29, 2026)
Google Threat Intelligence Group: The Proliferation of DarkSword (March 18, 2026)
Apple Support: Update iOS to Protect Your iPhone From Web Attacks