If you have an iPhone, listen up: There’s a new security risk that hackers have been actively exploiting since at least November. While you’re not likely to be the target of such an attack, your iPhone is nevertheless vulnerable, unless you take the following (albeit simple) action: update your iPhone.
What is DarkSword?
Google Threat Intelligence Group (GTIG) identified the new “full-chain exploit,” in partnership with security firms Lookout and iVerify. The exploit, called “DarkSword,” takes advantage of six zero-day vulnerabilities to compromise iPhones. GTIG says, as of November, it observed “multiple commercial surveillance vendors and suspected state-sponsored actors” using DarkSword in malware campaigns. As of now, those targets have been in Saudi Arabia, Turkey, Malaysia, and Ukraine.
DarkSword can attack iPhones running iOS 18.4 through iOS 18.7, according to GTIG (though iVerify and Lookout say the exploit they tested ends at iOS 18.6.2). The chain uses three malware families (GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER), and is similar to a previously-discovered malware kit named Coruna. As it happens, Apple recently issued patches for Coruna exploits for older iPhones.
DarkSword is designed to quickly and stealthily scrape credentials and personal information off your device, including passwords, keys, documents, emails, crypto wallets, usernames, photos, among other data points. This is done in seconds or minutes, so it doesn’t take long for DarkSword to work. An attack works like this: You’re browsing a website in Safari embedded with a malicious iframe. Once Safari encounters it, DarkSword can breakout of the WebContent sandbox, which typically prevents unauthorized services from running in areas of iOS they’re not supposed to. As such, it quickly gives itself permission to access privileged processes, and gains access to sensitive parts of iOS.
This is concerning, since the malware only requires the user to visit a malicious website to work. You don’t need to be tricked into downloading a malicious file; just clicking the wrong link seals the deal. That’s how GTIG initially discovered DarkSword: Hackers targeted users in Saudi Arabia with a fake Snapchat website called “Snapshare,” which brought the user to a legitimate Snapchat site while silently stealing their information in the background. In another example, a group suspected of working with the Russian government targeted users in Ukraine with malicious versions of official Ukrainian government and news sites.
How to protect yourself from DarkSword
Luckily, GTIG reported DarkSword to Apple back in late 2025, and since then, Apple has fully patched the exploits involved. The company didn’t issue the patches all at once, however; rather, Apple ran individual patches through various updates, releasing the final fixes with iOS 26.3 and iOS 18.7.3. As such, you need to be running at least those versions of either iOS 26 or iOS 18 in order to protect yourself from this malware kit.
What do you think so far?
Updating your iPhone isn’t hard, and it makes it easier that Apple doesn’t require you to update to the most recent version (i.e. iOS 26) in order to patch your device. However, there are many iPhones in this world, and getting everyone to update to the proper version isn’t easy. According to Apple, 66% of iPhones in the world run iOS 26, while 24% still run iOS 18. While we can’t know for sure which of those iPhones are running iOS 26.3 or iOS 18.7.3 or newer, it’s safe to say many are running outdated versions of each. There could be millions of iPhones at risk.
That risk, in my view, is quite low: Based on the current reports, these threat actors are targeting users in limited areas, and are being run by sophisticated networks, including those funded by governments. If you don’t have reason to be in the crosshairs of a government agency, especially one that would target users in Saudi Arabia, Turkey, Malaysia, and Ukraine, you’re not likely to be a victim of DarkSword.
Still, why take the risk, however small? If DarkSword continues to spread, perhaps its affects will as well. When the solution is as simple as updating your iPhone, what’s the harm?
