Can a Fake iPhone Duo Preorder Page Hack My Phone?

Short answer: yes, if your iPhone is out of date. Fake preorder pages for Apple's new folding iPhone can start attacking an older iPhone the moment the page opens, before you tap or type anything.

What the fake preorder page looks like

The iPhone Duo is Apple's first folding iPhone. Real preorders don't open until October 16, 2026, but fake preorder pages are already out there. They copy Apple's look, show a countdown clock, and offer a $500 voucher plus free AppleCare+ if you "reserve" now.

The deal is not real, and neither is the order. You can fill in the form and press the button, and the page shows "Pre-Order Successful". But nothing is ordered and no phone will ever arrive. The form is only there to keep you busy.

Why just opening the page is dangerous

While you look at the voucher, hidden code on the page tries to break into the iPhone itself. It uses a set of security flaws in older versions of iOS, specifically iOS 18.4 to 18.6.2. You don't have to download anything, tap a link inside the page, or approve anything. Opening the page in Safari is enough to start the attempt.

If it works, it goes after almost everything on the phone: saved passwords, Apple Notes, messages, call history, contacts, email, calendar, photo previews, location history, and crypto wallet apps such as MetaMask, Coinbase Wallet and Trust Wallet.

How to spot a fake preorder offer

1. Check the date. Apple's iPhone Duo preorders open on October 16, 2026. Any "early access" or "reserve now" page before then is fake.
2. Be suspicious of big discounts. Apple doesn't hand out $500 vouchers for preordering a brand-new phone. A deal that good is bait.
3. Look for details that don't match. The fake pages list colors and screen sizes that Apple doesn't sell for the Duo. If the options look like an older iPhone, close the page.
4. Watch for countdown clocks. A timer telling you the offer is about to end is there to stop you from thinking.
5. Don't trust the link, trust the address you type. Preorder links in ads, texts, emails and social media posts are exactly how people end up on these pages.

How to preorder safely

Wait until October 16. Then use the Apple Store app, type apple.com into your browser yourself, or go through a phone carrier or shop you already use. Do the same for any big launch: new phones, game consoles and concert tickets all attract fake preorder pages.

Update your iPhone today

1. Open Settings, then General, then Software Update.
2. Install any update waiting there.
3. Restart your iPhone when it finishes.
4. Turn on Automatic Updates on the same screen, so you're covered next time.

If you opened one of these pages on an older iPhone

1. Update and restart the phone first, using the steps above.
2. Change your important passwords from a different device you trust, starting with your email, Apple Account and banking apps.
3. If you hold crypto, move it to a brand-new wallet. A wallet whose details may have been copied is not safe to keep using.
4. Watch your bank and card statements for anything you don't recognize, and call your bank on the number on the back of your card if you see something.
5. Report the page to your country's fraud reporting service so it can be taken down.

The rule for every new gadget launch is the same: the best deal is never a link that found you. Go to the shop yourself.

Source: Malwarebytes: Fake iPhone Duo preorder scam triggers DarkSword attack