A fake pre-sale page for the newly announced iPhone Duo, Apple's first foldable device, is being used as bait to distribute malicious code. The page, which posed as official, attempted to exploit iOS vulnerabilities through the DarkSword exploit chain.
The fraudulent site displayed model offers and colors that do not match Apple's official specifications and featured elements like resetting countdown timers and broken links. While it simulated the completion of a pre-order, the malicious code was activated simply by opening the page, attempting to compromise the device.
The DarkSword chain, described by Google Threat Intelligence Group, can gain elevated access to a vulnerable iPhone's system. If exploitation were successful, the code could steal personal data, stored credentials, notes, cryptocurrency wallet files, and photo thumbnails. Apple has since patched the exploited vulnerabilities in iOS updates.
