Fake iPhone Duo Ransomware: DarkSword Exploit Targets iOS Users (September 2026)

Unknown Organizations: What Happened

A sophisticated ransomware campaign has been identified leveraging a fraudulent preorder page for the unreleased iPhone Duo. The campaign, which is global in scope, uses the DarkSword exploit chain to target iPhones running outdated iOS versions. When victims visit the malicious preorder site, exploitation occurs in the background with no user interaction required. Attackers gain unauthorized access to sensitive data, including credentials, cryptocurrency wallet information, and personal files, with confirmed theft of data from multiple wallet applications and device storage.

Attack Vector & Technical Detail

The attack is initiated via a fake iPhone Duo preorder page, which serves as the delivery mechanism for the DarkSword exploit chain. The malicious domain, pnmrud.cc, is a confirmed IOC associated with this campaign. Upon visiting the site, the exploit chain targets vulnerabilities present in older iOS versions, enabling the attackers to bypass standard user interaction requirements. The tactics align with MITRE ATT&CK techniques TA0001 (Initial Access), TA0005 (Defense Evasion), and TA0006 (Credential Access). No CVEs have been publicly attributed to this exploit chain at the time of reporting, but the attack demonstrates advanced exploitation of iOS browser and system weaknesses.

Confirmed Impact

The impact of the DarkSword campaign is significant, with potential theft of saved credentials, cryptocurrency wallet data (including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper), Apple Notes, messages, call history, contacts, emails, calendar entries, and location information. The campaign poses a substantial privacy and financial risk to affected users globally, particularly those who have not updated their iOS devices. The loss of cryptocurrency funds and exposure of personal communications and location data may have regulatory and legal implications for organizations and individuals in multiple jurisdictions.

What This Means for Your Organization

Organizations should be aware that ransomware campaigns are increasingly leveraging social engineering and zero-click exploit chains to compromise mobile devices. The use of a high-profile product launch as a lure increases the likelihood of user interaction with malicious infrastructure. It is critical to ensure all managed iOS devices are updated to the latest supported versions, and to educate users about the risks of engaging with unofficial preorder or promotional sites. Monitoring for connections to known malicious domains such as pnmrud.cc should be prioritized in security operations.

Detection & Response

• Immediate: Instruct all users to update iOS devices to the latest version and avoid interacting with unofficial preorder pages.
• Hunt: Search network and device logs for any connections to pnmrud.cc or evidence of unauthorized access to wallet applications and personal data.
• Patch: N/A (No specific CVE identified; apply all available iOS security updates).

Source: https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack