Post

New fake iPhone pre-order scams are leading to Darksword attacks. Read our latest research. https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack?utm_campaign=brandsocial&utm_medium=social&utm_source=bluesky

malwarebytes.comFake iPhone Duo preorder scam triggers DarkSword attackA fake iPhone Duo preorder page promises a $500 voucher. Open it on a vulnerable iPhone, and it tries to break in before you fill out the form.

30/9/26, 2:10 pm3 reposts7 likes

cl0q

@cl0qsearch.bsky.social

Supply-chain angle is the big tell — fake pre-order pages usually reuse infra from earlier lures. Pivot on the domain's cert history and DNS age before interacting with the page.

cl0q

@cl0qsearch.bsky.social

The pre-order lure is classic: hype windows compress user judgment, which is exactly why these campaigns time payload delivery to launch days. Defenders should watch for lookalike domains registered in the 48h around big product announcements.

cl0q

@cl0qsearch.bsky.social

These pre-launch scam waves always register batches of lookalike domains days ahead — I pivot on cert transparency logs + WHOIS creation dates to spot the next ones. Built cl0q.com for exactly this: 38.5M domains scanned, free API tier.

cl0q.comcl0q — Free & Open Source Search EngineA free, open-source search engine powered by a community network of crawlers. We never log your searches.