Fraudulent syndicates are taking advantage of the iPhone replacement craze and are waiting for opportunities. iPhone users who have not updated their systems in time should be careful about the risk of attacks. (Bloomberg)
[Reporter Qiu Qiaozhen/Taipei Report] As the sales of Apple’s new iPhone Duo count down, fraud groups are also taking advantage of the phone replacement craze and are waiting for opportunities. TrendLife, a consumer business group of Trend Micro, recently discovered that there are a number of suspicious websites with new iPhone themes. In addition to common fake pre-orders and fake discount advertisements, some malicious websites even use known iOS vulnerabilities to launch attacks. Even if users do not enter their account password or press the purchase button, just opening the web page may expose iPhone users who have not updated their systems in time to the risk of attack.
Trend Micro TrendLife pointed out that the research team discovered multiple suspicious websites with the theme of new iPhones before and after the release of Apple's new products in 2026, which can be mainly divided into three types. The most noteworthy ones are malicious websites pretending to be "iPhone Duo free lottery" and discount activities.
The research team found that such websites would load different attack codes based on the iOS version used by visitors, thereby exploiting known iOS vulnerabilities to launch attacks. Unlike traditional fake shopping websites, this type of attack does not necessarily require users to actively enter personal information or complete payment. As long as the device has unpatched vulnerabilities, opening a malicious webpage may become the starting point of the attack, further leading to the theft of account credentials or even account takeover.
In addition to exploiting system vulnerabilities to launch attacks, another common technique is to fake new product pre-order websites. Trend Micro pointed out that fraud groups take advantage of consumers' worries about not being able to grab a new phone, and use words such as "advance pre-order" and "limited time offer" to induce people to place orders quickly. Some fake websites will even quickly update the page content after Apple officially announces the price, specifications and launch information of the new phone, making the website look more realistic and making it more difficult for consumers to identify.
The third category is fake advertising diversion websites packaged in iPhone or Apple-related names. This type of website does not necessarily directly defraud consumers for payment, but uses Apple or iPhone-related names to attract people to click, and then directs visitors to other advertising, registration or affiliate marketing pages, and earns commissions by clicking or completing specified actions.
Trend Micro reminds that affiliate marketing itself is not a scam, but even if Apple or iPhone appears in the website name, it does not mean that it has an official partnership with Apple, and the claimed benefits are not necessarily provided by the official website.
Faced with the large amount of pre-order and promotional information that appears during the launch of new phones, Trend Micro also reminds consumers to pay attention to three major warning signs. First of all, you should be more vigilant if the website constantly urges immediate payment with "countdown timer", "limited time sale" or "last few units"; secondly, if the model, specifications, price or launch date in the purchase information are inconsistent with Apple's official announcement, there may be risks; thirdly, you should avoid rashly clicking on unknown pre-order links from unfamiliar messages, social posts or advertisements.
How to reduce the risk of being deceived and attacked? Trend Micro recommends that you confirm whether the URL and domain are correct before clicking. If necessary, you can use anti-fraud tools to help check suspicious links.
In addition, since some malicious websites may exploit known iOS vulnerabilities to launch attacks, regularly updating the iPhone operating system and App is also an important protective measure. Users should also enable multi-factor authentication or pass keys for important accounts to reduce the risk of account passwords being taken over after being stolen.
If you have entered your credit card information on a suspicious website, you should contact the card-issuing bank as soon as possible; if you suspect that your account password has been leaked, you should also change your password immediately and check other accounts using the same password. Faced with various messages claiming "limited time", "early pre-order" and "official offers", the more you are urged to place an order immediately, the more you should check first to avoid threats to your credit card information, account password and even device security.
