Fake Shopping Websites Now Hack Your Phone Without a Payment

On 21 October, CyberDost — the Home Ministry’s cybercrime awareness arm under I4C — warned Indian shoppers about fake festive sale ads leading to lookalike shopping sites. Good advice, correctly timed. Check the URL, avoid sponsored links, do not pay in advance, prefer cash on delivery.

But that warning describes a scam that wants your money. There is a newer version doing the rounds that does not want your money at all, and the usual advice does not stop it. Some fake shopping websites are no longer after your card details. They are after your phone.

What the government actually warned about

CyberDost’s 21 October advisory describes a familiar pattern: advertisements carrying real brand logos, real product photography and real-looking sale graphics, linking to fake shopping websites built to resemble official brand platforms. Pay there and, in the advisory’s framing, the money goes straight to the scammer.

Its checklist is sound and worth repeating: verify the URL before you shop; do not click ads or links from unknown sources; check any offer by opening the retailer’s own site or app yourself rather than following the link; treat sponsored search results with suspicion; refuse advance payment on sites where you cannot verify the seller; and use cash on delivery where you can inspect before paying.

Every one of those steps protects your bank balance against ordinary fake shopping websites. None of them protects your phone, because they all assume the damage happens when you pay.

The fake shopping websites that do not want your money

Researchers at Malwarebytes recently found fake Apple pre-order pages for the newly launched foldable iPhone, dressed up with a $500 voucher and free AppleCare+ under an “Authorized Partner Exclusive” banner.

The interesting part is what the form does: nothing. Fill it in and you get a cheerful “Pre-Order Successful” message while your details are discarded. The form is set dressing. The actual attack runs the moment the page loads — a hidden frame fingerprints your device, checks your iOS version, and steers iPhone visitors into Safari, which is where the exploit works.

You do not have to pay. You do not have to submit anything or download anything. Among fake shopping websites, this is a meaningful change: the page is not a storefront, it is a delivery mechanism, and the “do not enter your card details” advice never gets a chance to apply.

We covered the device-specific side of this in our piece on the iPhone Duo launch in India. What follows is the part that matters to everyone else.

DarkSword: how a spy tool ended up on fake shopping websites

The code on those pages matches DarkSword, an iOS exploit chain that Google’s Threat Intelligence Group documented in March 2026 alongside research from Lookout and iVerify.

DarkSword did not start out hunting shoppers. It was used from at least November 2025 by commercial surveillance vendors and suspected state actors: a Saudi-focused campaign using a Snapchat-themed site, customers of Turkish surveillance vendor PARS Defense targeting users in Turkey and Malaysia, and a suspected Russian group running watering-hole attacks against Ukrainian visitors, paired with a backdoor called GHOSTBLADE.

Then it leaked downhill, which is what always happens. AttackIQ’s Pete Luban put the general principle neatly — “the same access and tooling can enable both outcomes in the same campaign” — and the money motive shows in what DarkSword reaches for: cryptocurrency wallets.

What it chains together

Six separate vulnerabilities: three in WebKit, two in the kernel, one in dyld. Apple fixed them across a run of releases rather than all at once — CVE-2025-31277 in iOS 18.6 in July 2025, two kernel flaws in iOS 26.1 and 18.7.2 in November 2025, two more WebKit flaws in iOS 26.2 and 18.7.3 that December, and the dyld bug in iOS 26.3 in February 2026. Later patches extended coverage to iOS 18.7.7 on 1 April 2026.

Mechanically, Safari loads the hidden frame, the chain escapes the WebContent sandbox, uses WebGPU to get into a media process, and takes kernel read/write access to rewrite its own restrictions. That is a full compromise from a page visit.

Why you would never know

This is the uncomfortable detail. The payload collects what it wants in seconds to minutes and then deletes itself. GHOSTBLADE, the companion backdoor, does the same. There is no slow battery, no pop-up, no strange app. The absence of symptoms tells you nothing at all.

What it takes, where it succeeds, is not a short list: passwords, encryption keys and files for DarkSword itself; and for GHOSTBLADE, location history, photos, calendar entries, notes, Safari history, installed apps, account details and cryptocurrency wallet data.

Are you actually at risk from these fake shopping websites?

Here is the reassuring part, stated as plainly as the scary part.

All six vulnerabilities are patched. If your iPhone is running a current iOS, DarkSword does not work on it. iVerify’s guidance points to iOS 18.7.6 or 26.3.1 as safe floors, and Malwarebytes’ advice is simply to install the newest version your device will take.

The problem is everyone who has not. iVerify estimated that more than 200 million devices worldwide may still be vulnerable — that is an estimate, not a count, but the scale is the point. Old iPhones that stopped prompting, hand-me-down devices, second phones in a drawer, the one your parents use — those are the phones fake shopping websites of this kind are built for.

Malwarebytes also did not test the payload on a live iPhone or watch data leave a device, so whether these particular fake shopping websites are successfully compromising anyone is unconfirmed. The honest summary: patched phone, not your problem. Unpatched phone, a real one.

How to spot fake shopping websites in 2026

The old advice is still necessary. It is just no longer sufficient.

Check the address bar, not the logo

Logos, product shots and page layouts are trivially copied — that is the easiest part of building fake shopping websites, not the hardest. The domain is the one thing a scammer cannot borrow. Read it character by character before you do anything else, and be suspicious of hyphens, extra words and unfamiliar endings.

Treat sponsored results as untrusted

CyberDost specifically called out sponsored search results, and that is not paranoia — buying an ad against a brand name is cheap and the ad sits above the real result. Scroll past the paid block, or skip search altogether and type the address yourself.

Be most suspicious when the offer is most tempting

Scarcity is the hook. Roughly 6,000 units of a phone in India’s first week, sold out on one quick-commerce app in minutes, resale premiums of ₹50,000 and up — a page promising a way in is pushing on exactly the thing you want to be true. The same logic we applied to festive sale discounts works here: the better the deal sounds, the harder you should look at it.

Keep the phone patched, because that is the only control that works

Every other item on this list depends on you noticing something. Patching does not. Settings, General, Software Update, and turn on automatic updates while you are there.

Lockdown Mode, if you are actually a target

Settings, Privacy & Security. It makes the phone noticeably less pleasant to use and it is genuinely effective against targeted attacks. It is for journalists, activists and people handling sensitive material — not for everyone, and nobody should feel they need it to shop online.

If you think you already opened one of these fake shopping websites

Update iOS and restart the phone. The researchers found no mechanism that survives a reboot, though a restart cannot undo data that is already gone.

Then change any passwords that might have been exposed, from a different device you trust — not the phone in question. If you keep cryptocurrency on it, treat the wallet as burned: new wallet, new recovery phrase, move the funds, and secure any exchange accounts separately. Turn on multi-factor authentication on financial accounts, with an app or a security key rather than SMS. For larger crypto holdings, a hardware wallet is the right answer and a phone never was.

Finally, review what your apps can reach — location, photos, contacts, microphone, camera — and revoke what does not need to be there.

What about Android users?

DarkSword is an iOS chain. It does not run on Android, and an Android phone visiting one of these pages is not exposed to this particular attack.

That is not a reason to relax. The CyberDost warning applies to every shopper regardless of platform, the payment-theft version of fake shopping websites is far more common than the exploit version, and Android has its own history of browser-delivered attacks. The lesson is not “iPhone bad, Android safe.” It is that a web page you did not choose to visit can now be an attack, and the platform only determines which attack.

The Honest Fine Print

Nobody has confirmed a victim. Malwarebytes found the pages and matched the code. They did not observe a successful compromise. We are telling you about a capability that exists and is deployed, not a wave of people who have been robbed.

The patched-is-safe point is the headline, not the footnote. It would be easy to write this as “state-grade spyware is coming for shoppers” and leave out that every bug involved was fixed months ago. That omission is how security coverage turns into anxiety with no action attached.

200 million is an estimate. It comes from iVerify and describes devices that may still be vulnerable worldwide. It is not a measured count and it is not India-specific. We have not found a credible figure for how many unpatched iPhones are in use here.

We have not examined one of these fake shopping websites ourselves. We are not going to go looking for live malware to screenshot it. Everything about the fake pre-order pages comes from Malwarebytes’ reporting.

The government warning and the exploit story are separate things. CyberDost warned about payment fraud. We have connected it to a different threat that happens to use the same disguise. That connection is our editorial judgement, not something the advisory says.

Frequently Asked Questions

How do I spot fake shopping websites?

Read the domain carefully before anything else — hyphens, extra words and odd endings are the tell, because the logo and layout are copied in minutes. Verify any offer by opening the retailer’s official app or typing their address yourself. Treat sponsored search results as unverified.

Can a website hack my phone without me clicking anything?

On an unpatched iPhone, yes — that is what the DarkSword chain does, triggering from a page load in Safari rather than a tap. On a current iOS version it does not work, because all six of the vulnerabilities it relies on have been patched.

Which iOS version am I safe on?

iVerify points to iOS 18.7.6 or 26.3.1 as safe floors against this chain, and later patches went further. The practical answer is to install the latest version your iPhone supports and switch on automatic updates.

Will antivirus protect me from fake shopping websites?

Partly. Scam-blocking tools can stop you reaching a known malicious page, which is useful. They cannot fix an unpatched vulnerability, so they are a supplement to updating, never a replacement.

I entered my card on a suspicious site. What now?

Contact your bank immediately to block the card and dispute anything pending, change the password on any account you reused, and report it on the national cybercrime portal. Acting within hours matters more than anything else you do.

Is this related to the PHP website attacks?

No — separate issue. That one was about servers running websites rather than phones visiting them. We covered it in our PHP vulnerability guide for site owners.

Bottom line

The government’s festive-season warning is right and you should follow it. Just understand what it covers. Checking the URL and refusing advance payment protects your money from the ordinary version of fake shopping websites, which is still the version you are overwhelmingly most likely to meet.

The newer version does not care whether you pay, and the only defence that reliably works against it is the one that requires no vigilance at all: an updated phone. If you do one thing after reading this, make it Settings, General, Software Update — on your phone, and then on the phone belonging to whoever in your family never updates theirs.

Sources

• Digit — CyberDost I4C advisory of 21 October 2026 and its safety checklist
• Help Net Security — the six CVEs, patch timeline and the campaigns attributed to DarkSword
• Dark Reading — the shift from state actors to financially motivated use, and iVerify’s exposure estimate
• Malwarebytes — affected iOS versions, Lockdown Mode guidance and practical user advice
• eSecurity Planet — the fake pre-order pages and how they are built