You can’t preorder the iPhone Duo until Oct. 16, but beware of a fake ad out there that says otherwise. Falling for it could expose a lot of personal and financial data and could even lead to theft of your cryptocurrency, if you have any.

The sleuths at Malwarebytes spotted the scam, which tries to trick people into thinking they can save $500 by preordering the iPhone Duo, Apple’s first foldable phone. However, Apple has already said the Duo won’t be available for preorder until Oct. 16 and won’t go on sale in stores until Oct. 23.

The cybertheft uses the DarkSword exploit chain, which targets typically older iPhones that don’t have the latest security and software updates. DarkSword can compromise a device and steal data even if you simply visit a malicious web page. You don’t even need to click on or type anything to be victimized.

The iPhone Duo scam targets iPhones that are running iOS 18.4 to 18.6.2 and iPads to a lesser extent. The scam doesn’t target iPads or Macs, Malwarebytes said.

The DarkSword exploit begins as soon as the scam page loads onto your browser. The page appears legit for the most part. It’s got the Apple logo, font and language style, and there aren’t any spelling, grammar or punctuation mistakes typical of most webpage scams. It’s even got an Apple copyright at the bottom. But, as Malwarebytes points out, the privacy, terms, and sales policy links go nowhere.

This scam page uses Apple font and style to trick users into thinking it’s legitimate.Malwarebytes

Clicking the “Claim $500 Voucher” button takes you to a submission form with a few telltale indicators that it’s a scam, according to Malwarebytes. The finish color menu lists natural titanium, although the iPhone Duo only comes in star white and night sky. The form also lists size options of 6.3 and 6.9 inches, which are incorrect — the phone is 7.6 inches unfolded and 5.4 inches folded.

Filling out the form is meaningless, Malwarebytes said. If you do fill it out and submit it by clicking on the blue button, you’ll get a “Pre-Order Successful” message. By that time, however, the data theft on your iPhone has already begun.

This info submission page helps kick off the data theft scam.Malwarebytes

The payload — the malicious code of software that does the stealing — goes after your passwords, messages, call history, contacts, voicemail, email, photos, app info, cryptocurrency wallet data and Apple Notes.

If you’re using a browser other than Safari, the default browser on Apple devices, a “Browser Restricted” page will direct you to open Safari, which DarkSword uses to infiltrate the device. If it can get past the iPhone’s security protections, it will begin stealing data.

How to avoid this scam

Apple says that devices running the latest versions of iOS 15 through iOS 26 are already protected. To make sure your iPhone is running the latest iOS update, go to Settings > General > Software Update. If your phone allows, install the most updated version of iOS 26 (with iOS 27 coming soon). While you’re there, also turn on Automatic Updates. An Apple support page gives more details on how to protect your iPhone from web attacks.

Read more: 5 iPhone Duo Features I’m Already Dying to Try

Also, if you’re interested in iPhone Duo preorders, only go to Apple’s official store website or other reputable online stores, such as Best Buy or your cellphone carrier. Don’t be tempted by ads, texts or social media posts that offer preorder deals by clicking on a suspicious URL.

If you accidentally clicked…

OK, stuff happens. If you fell victim to this scam, update your iPhone, then restart it. Malwarebytes said the data-stealing payload does not return after the phone is rebooted. Sadly, there is nothing you can do about data that has been stolen before the reboot.

Malwarebytes listed several other things to do. If you have a cryptocurrency wallet on your iPhone, create a new one with a new recovery phrase and move the funds to it. If you have a crypto exchange account, secure it and contact the exchange.

Change passwords that might have been stolen. Go to a trusted device and change passwords for email accounts, Apple account and of course banking, crypto and other financial accounts. And activate two-factor authentication or even more than two factors.

Read more: A Reality Check From a Fold-aholic

Scam Guard and Browser Guard, both available from Malwarebytes — a cybersecurity suite highly rated by CNET — can spot scammy screenshots and links and block fake webpages from appearing on your internet browser.

Ever since being admittedly fascinated by the Cambridge coffee webcam from the 1990s, I've written about VPNs, the NFL, smartphones, living wages, over/unders and everything in between. See full bio