APPLE IMPERSONATION - FAKE STORE

The iPhone Duo voucher page started its attack before you read the offer.

Apple's first foldable went on sale on 23 October. Two kinds of fake store came with it: one that never wanted your money, and one that wanted it later, somewhere you could not get it back.

SB

SafeBrowz Threat Research Security Research · 1 November 2026 · 10 min read

A preorder page that opened before the preorders did

Malwarebytes published its analysis on 29 September 2026. That date is the first clue, and it is one you can use on the next launch too. Apple's own announcement set preorders for 5 a.m. Pacific on 16 October. So by 29 September, more than two weeks before Apple took a single preorder, a page dressed as Apple's store was already "taking" them.

The page looked the part. Apple's layout, "Copyright © 2026 Apple Inc." in the footer, a choice of models, and a ticking preorder deadline. The pitch was a $500 voucher labelled "Authorized Partner Exclusive" plus AppleCare+ coverage, in exchange for a short form: name, email, and phone number, with WhatsApp marked as preferred. No payment up front. Submit it, and the page congratulated you with its own "Pre-Order Successful" message.

None of that was real, and some of it fails a check you can do in seconds. The page offered 6.3-inch and 6.9-inch models, while the real Duo has a single size, with a 5.4-inch outer display and a 7.6-inch inner one, and the colours on offer were not ones Apple sells for the Duo. The privacy, terms and sales policy links went nowhere. And the countdown, according to Malwarebytes, started over whenever the page loaded. Reload the page, and the deadline that was about to expire has all its time back. A real stock deadline does not reset because you pressed refresh.

The form was the decoy

Most fake-store advice is about the moment you hand something over: your card, your password, your address. It assumes the page is harmless until you type into it. This page broke that assumption, which is why it is worth understanding even if you would never fall for a $500 voucher.

Malwarebytes found that on an iPhone, opening the page was enough to start the attack. An invisible frame checked which version of iOS the phone was running and picked the next piece of code to load to match it. The page also tried to reopen itself in Safari, and browsers the script did not recognise got a "Browser Restricted" notice instead of the offer, although Malwarebytes notes that background resources may still load. The form, the voucher and the success message were there to keep you on the page and feel like you had done something ordinary, while the real work happened underneath.

That real work was DarkSword, an exploit chain Google disclosed in March 2026 that covers iPhones on iOS 18.4 to 18.7. Apple fixed it in late March and early April with iOS 18.7.7, first for older models and then for all iOS 18 iPhones, and told users to move to iOS 26 for its strongest protections. iVerify had estimated that up to 270 million devices ran iOS 18.4 to 18.6.2, the versions targeted by the variant iVerify analysed, and Malwarebytes is careful to say that is not a current count. The exact iOS range this page went after is unconfirmed, though its files include code for older versions. The point is not the size of the number. It is that a phone you stopped updating in the spring is the kind of phone this page was built for.

What the captured code reached for, per Malwarebytes, which analysed it rather than running it on a device: saved passwords from the keychain, the list of installed apps, Apple Notes, messages, contacts, call history, voicemail, email, calendar entries, cached location data and photos. It also went after wallet files for MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus and Tonkeeper, and it deleted the diagnostic reports that would have helped anyone investigate afterwards. It also left a channel open for its server to send more instructions. Anyone who keeps a crypto wallet on their phone should read that list twice.

The two hosts Malwarebytes named, and where they sit now

Malwarebytes published two indicators for this campaign. pnmrud[.]cc is the command-and-control and collection server, the place the stolen data was sent. cloud[.]cmatgldn[.]click is an ad click and conversion tracker, which suggests at least some visitors arrived through ads, with the operator counting who clicked.

We checked both on 1 November 2026. Both still resolve. The collection server's domain was registered on 17 September 2026, twelve days before the analysis appeared, which fits a page built for one launch and nothing else. Malwarebytes did not publish the address of the preorder page itself, so we cannot show it to you, and we would not link to it if we could.

Both hosts are on our block list as of today, with the campaign and the source recorded against each one, and you can click either red name above to see the verdict come back. Before we added them, our scanner rated both as "caution", not danger. That is the honest starting point for the next section.

The second scam took no card, and that was the trick

Kaspersky's warning, published on 23 October as the Duo went on sale, describes a different operation that is easier to underestimate. An English-language fake store offered the iPhone Duo at 25% off, in Apple's visual style, with a countdown telling visitors only 30 minutes were left. At checkout it asked for contact details and a shipping address, and nothing else. No card number. Then it said a manager would contact the customer later to arrange payment.

Think about which advice that page beats. "Only enter your card on a secure checkout." It never asks for a card. "Check for the padlock." Irrelevant when nothing sensitive is typed. "Use a credit card so you can charge it back." There is no card transaction to dispute. The site's only job is to collect contact details from someone who has just been told a $1,999 phone is theirs for a quarter less, and hand that person to a "manager" who, in Kaspersky's words, will "confirm delivery arrangements and payment details". That later conversation is where the money goes, and in schemes built this way it typically goes by a method with no reversal button, such as a bank transfer.

Kaspersky also found multilingual versions of the same idea: pages that let the visitor choose a language and a currency, show off the Duo's features, take a preorder, and promise a redirect to Apple's official site that never happens. The scam is not limited to English-speaking buyers, and the attempts were seen in different parts of the world.

The two operations want different things. The voucher page wanted the phone. The discount store wanted a conversation. What they share is the launch, and a link that arrives in front of you rather than one you went looking for.

What the real iPhone Duo launch looks like

• Where: apple.com and the Apple Store app, plus carriers and retailers you already deal with. Apple did not offer preorder vouchers through "Authorized Partner Exclusive" pages. Buy from Apple or from a carrier or retailer you reach yourself.
• When: preorders opened at 5 a.m. Pacific on 16 October 2026 and deliveries began on 23 October. Anything taking preorders before 16 October was not Apple.
• Price: from $1,999 for 256GB in the United States, rising through 512GB and 1TB to $3,199 for 2TB.
• Colours: star white and night sky. A third colour is a fake store's guess.
• Payment: at checkout, on the page. A real store does not take your address now and call you later about the money.

Red flags on an iPhone Duo deal

• A voucher, a gift, or free AppleCare+ in exchange for filling in a form.
• A countdown that gets its time back when you reload the page.
• A checkout that takes your phone number and address but no payment, and promises someone will be in touch.
• A page that tells you your browser is not supported, or insists on reopening in Safari.
• WhatsApp offered as the preferred way to reach you about an order.
• Colours, sizes or prices that do not match Apple's own listing.
• Footer links to privacy, terms or sales policies that go nowhere.
• The link reached you in an ad, a text or a social post, rather than you typing the store's address.

Stop a fake launch page before your phone opens it

The voucher page changes where a defence has to sit. If the attack starts when the page loads, then any check that happens after the page loads, including your own judgement of how convincing it looks, comes too late. The useful moment is the one between receiving the link and opening it.

We should be plain about our reach here, because this attack is aimed at iPhones and our browser extension and phone app do not run on iPhone yet. The SafeBrowz extension works in Chrome, Firefox and Edge, and our app is on Android; a Safari version is built and waiting to be published. So on the iPhone itself, we are not sitting in front of Safari. What does work today is checking the link before the iPhone ever opens it: paste it into the checker below from any device, or let the extension check it if the ad or message reached you on a computer. A host on our block list, like the two above, comes back as danger instead of loading.

That covers what is known. The harder question is a page nobody has reported yet, and here we would rather be precise than reassuring. A hostname that pairs "apple" with extra words on a domain Apple does not own is the kind of thing our brand rules exist for. A hostname built only on "iphone" is not something we flag by spelling alone, because real news, accessory and fan sites start their names with that word, and a rule that caught the fake would catch them too. For pages like that, the work falls to the content read: Layer 3, our AI deep scan in Premium, looks at what a page is doing, an Apple store layout on a domain that is not Apple's, a voucher for a form, a checkout with no payment step, rather than at how its name is spelled.

Where this stops, honestly: a scanner cannot patch your phone. The defence against DarkSword specifically is an up-to-date iOS, and no block list replaces that. What a block list can do is tell you a link is bad before you open it on a phone you have not updated yet, and that is worth having while you get round to it.

A 30-second check before you take a launch deal

1. Go to the store, not the link. Type apple.com or open the Apple Store app, and look for the deal there. If it is not there, it is not Apple's.
2. Reload the page once. If the countdown starts over, the urgency is fake, and so is the rest.
3. Ask how you will pay. If the answer is "later", "a manager will call", or anything that leaves the website, close it.
4. Check your iOS version. Settings, then General, then Software Update. If an update is waiting, install it before you open any more preorder links.

If you opened the page or sent your details

• Opened the voucher page on an iPhone: update iOS now and restart the phone. A restart does not undo anything already taken, so from a different, trusted device change your Apple Account password first, then email, banking and any crypto exchange accounts, and turn on two-factor authentication where it is off.
• Kept a crypto wallet on that phone: treat the recovery phrase as exposed. On a trusted device, create a new wallet with a new phrase and move the funds there. Changing a password does not protect a wallet whose files have been copied.
• Gave your number to a discount store: expect a call or a WhatsApp message from the "manager". Do not pay, whatever they offer, and block the number. If you already paid by bank transfer, call your bank today, because the first few hours matter most.
• Report it: forward phishing emails to [email protected]. In the United States, report the site at ic3.gov. In England, Wales and Northern Ireland, use reportfraud.police.uk; in Scotland, call Police Scotland on 101. Save the link and screenshots, but do not reopen the page to get them.
• Money has gone: our step-by-step guide for what to do after you have been scammed covers banks, card disputes and reporting in more detail.

The wider pattern here is not new, only the phone is. The same approach turns up in fake online stores generally, in fake luxury-brand storefronts, and in the malicious ads that deliver people to them. With the holiday shopping season starting, expect the next launch, and the next "partner exclusive", to arrive the same way.

Add to Chrome Add to Firefox Add to Edge Get it on Google Play