{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 0,
      "direct_entities": 3,
      "direct_relationships": 2,
      "invalid_iocs": 0,
      "iocs": 0,
      "mentioned": 1,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 2,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 24,
      "excluded_graph_objects": 60,
      "graph_complete": true,
      "graph_objects": 3,
      "graph_relationships": 2,
      "mitre_context_complete": true,
      "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
      "status_as_of": "2026-10-10T23:22:12+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-30T01:00:15.877Z",
          "updated_at": "2026-09-30T01:00:18.797Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "2362a8aa-7518-4075-8aaf-8f4d6bccc656",
        "is_inferred": false,
        "labels": [
          "credential stealing",
          "cryptocurrency theft",
          "darksword",
          "darksword exploit",
          "fake preorder",
          "ios vulnerability",
          "iphone duo",
          "safari targeting",
          "social engineering"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
        "standard_id": "hostname--532b04e7-7d95-5b90-8eb2-7de431c0ac2a",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-30T00:59:50.039Z",
          "created_at": "2026-09-30T01:00:15.708Z",
          "modified": "2026-09-30T01:00:39.405Z",
          "updated_at": "2026-09-30T01:00:39.405Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "c0c4a980-b15a-440a-b51c-4526d2be94b5",
        "is_inferred": false,
        "labels": [
          "credential stealing",
          "cryptocurrency theft",
          "darksword",
          "darksword exploit",
          "fake preorder",
          "ios vulnerability",
          "iphone duo",
          "safari targeting",
          "social engineering"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
        "standard_id": "indicator--fdcbfc04-8c5f-58fc-bce6-3e862fa2d86a",
        "type": "Indicator"
      },
      {
        "__typename": "Malware",
        "aliases": [],
        "attributes": {
          "is_family": false
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-30T00:59:49.982Z",
          "created_at": "2026-09-30T00:59:56.321Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-09-30T01:00:05.007Z",
          "updated_at": "2026-09-30T01:00:05.007Z"
        },
        "description_available": false,
        "entity_type": "Malware",
        "id": "c68c8dc3-f430-41c3-ab1f-a9593ab1d5b4",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "DarkSword",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
        "standard_id": "malware--15a78e93-851e-5adf-b016-a818de813b15",
        "type": "Malware"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-30T00:59:50.049Z",
          "created_at": "2026-09-30T01:01:42.628Z",
          "modified": "2026-09-30T01:01:44.806Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-30T01:01:44.806Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "c0c4a980-b15a-440a-b51c-4526d2be94b5",
        "from_id": "c0c4a980-b15a-440a-b51c-4526d2be94b5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "cb96fa6a-7246-4ad1-b7a0-1f85d8ddfff6",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
        "standard_id": "relationship--bcfea7d2-c6f9-5c15-8e6d-c64b866f0ff8",
        "toId": "c68c8dc3-f430-41c3-ab1f-a9593ab1d5b4",
        "to_id": "c68c8dc3-f430-41c3-ab1f-a9593ab1d5b4",
        "to_name": "DarkSword",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-30T00:59:50.048Z",
          "created_at": "2026-09-30T01:01:40.734Z",
          "modified": "2026-09-30T01:01:41.160Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-30T01:01:41.160Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "c0c4a980-b15a-440a-b51c-4526d2be94b5",
        "from_id": "c0c4a980-b15a-440a-b51c-4526d2be94b5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d73719a0-9047-4608-becd-c930fe987126",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack",
        "standard_id": "relationship--7d8e6b5c-6bed-5f79-acf3-2543e35dc38f",
        "toId": "2362a8aa-7518-4075-8aaf-8f4d6bccc656",
        "to_id": "2362a8aa-7518-4075-8aaf-8f4d6bccc656",
        "to_name": null,
        "to_type": "Hostname"
      }
    ],
    "iocs": [],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "c68c8dc3-f430-41c3-ab1f-a9593ab1d5b4",
        "name": "DarkSword",
        "role": "mentionné",
        "type": "Malware"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-29T13:59:04.344Z",
        "created_at": "2026-09-30T01:02:17.466Z",
        "modified": "2026-09-30T01:02:17.772Z",
        "published": "2026-09-29T13:59:04.344Z",
        "updated_at": "2026-09-30T01:02:17.772Z"
      },
      "description_available": true,
      "id": "f00c3775-5333-4e79-87dd-2abb1cd71be0",
      "is_inferred": false,
      "labels": [
        "credential stealing",
        "cryptocurrency theft",
        "darksword",
        "darksword exploit",
        "fake preorder",
        "ios vulnerability",
        "iphone duo",
        "safari targeting",
        "social engineering"
      ],
      "lang": "en",
      "name": "Fake iPhone Duo preorder scam triggers DarkSword attack",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-29T13:59:04.344Z",
      "references": [
        {
          "external_id": null,
          "id": "4a947911-95d2-465a-971f-6d927efaf439",
          "source_name": "alien-vault",
          "url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack"
        },
        {
          "external_id": "6abbc428d397735970a34334",
          "id": "43a4f63c-82e6-411f-9c2e-23a50432fc7b",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6abbc428d397735970a34334"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "f00c3775-5333-4e79-87dd-2abb1cd71be0",
  "schema_version": 1,
  "selected_date": "2026-09-29",
  "source_url": "https://www.malwarebytes.com/blog/threat-intel/2026/09/fake-iphone-duo-preorder-scam-triggers-darksword-attack"
}