Fake iPhone Duo Preorder Scam Puts Crypto Wallets at Risk

In this news:

Key takeaways

Fraudsters created a fake iPhone Duo pre-order website offering a discount voucher.
The malicious site employs the DarkSword exploit to target popular crypto wallets like MetaMask and Phantom.
Apple previously patched the exploit, but users remain vulnerable when clicking unverified links.

Crypto wallet scams have become more innovative in how they try to trick victims, and now scammers are making use of a fraudulent iPhone Duo pre-order website to attack vulnerable machines. The iPhone Duo will become available for pre-order from Friday, October 16, but fraudsters are attempting to lure people to the false website in order to place the pre-order already. The website hosting the virus looks very much like the original one and offers a $500 (roughly Rs. 48,100) discount voucher as an “Authorised Partner Exclusive”.

DarkSword payload can target saved wallet credentials and device data

Security experts at Malwarebytes claim that the page is employing the DarkSword exploit chain, which exploits certain iPhones that are not yet updated. There is nothing you need to do, and an attack will be launched as soon as you open a page. If successful, it gathers device identification data and tries to send a list of installed apps as well as your Apple Notes content. After performing these actions, the malware focuses on crypto wallets. In particular, it searches for wallets like MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. In addition to that, it also tries to extract saved credentials from the phone's keychain.

Once it locates a wallet of interest and its server connections are successful, it tries to upload wallet files, extracted credentials, and thumbnail pictures. Disclosure of wallet files or credentials can endanger the safety of the funds. The program further attempts to gain access to the messages, contacts, call logs, voicemails, emails, calendar appointments, and cached location data. The payload is also capable of contacting its server to get additional instructions. The exploit chain was reported by Google back in March and fixed by Apple in the same month.

Previous App Store incidents and ongoing risks

This is not the first time that Apple has been caught in the crossfire of crypto wallet scams. In July, the company faced a case filed by three customers who claimed to have lost about $1.8 million (roughly Rs. 17.24 crore) when they downloaded a fake Bitcoin wallet from Apple's App Store. This complaint was filed in the US District Court for the Northern District of California, and it asserts that Apple has neglected to examine the apps in question despite its claim that the App Store is a reputable place for downloads.

The recent fraud case serves as an indication of how cryptocurrency wallet users can be vulnerable to scams even without direct interaction with a fraudulent wallet app and authorisation for any transaction. Although DarkSword exploits have been fixed by Apple, the case has brought forward dangers associated with visiting shady links. Users need to make sure that they keep their devices up-to-date and avoid clicking on pre-order or discount-related links.

Share the article: