iPhone users should take note: a new security threat known as DarkSword has been actively exploited by hackers since November. While the likelihood of being targeted may be low, it's crucial to ensure your device is secure by simply updating it.
Understanding DarkSword
The Google Threat Intelligence Group (GTIG) has identified DarkSword as a comprehensive exploit that utilizes six zero-day vulnerabilities to infiltrate iPhones. Collaborating with security firms like Lookout and iVerify, GTIG has noted that this exploit has been leveraged by various commercial surveillance vendors and possible state-sponsored groups, primarily affecting users in regions such as Saudi Arabia, Turkey, Malaysia, and Ukraine.
DarkSword targets iPhones running iOS versions 18.4 to 18.7, with some reports indicating that its effects may extend to iOS 18.6.2. The exploit employs three distinct malware families--GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER--and bears resemblance to a previously identified malware kit called Coruna. Recently, Apple has issued patches addressing the vulnerabilities associated with Coruna for older iPhone models.
The primary function of DarkSword is to swiftly extract sensitive information from your device, including passwords, documents, and even crypto wallet details, all within a matter of seconds. The attack mechanism is alarmingly straightforward: while browsing in Safari, a malicious iframe can trigger DarkSword, allowing it to escape the WebContent sandbox and gain unauthorized access to critical iOS processes.
This threat is particularly concerning as it only necessitates that the user visits a compromised website. GTIG's investigation revealed that hackers initially targeted Saudi Arabian users through a fake Snapchat site called "Snapshare," which redirected users to the legitimate Snapchat platform while covertly gathering their data. Another incident involved a group believed to be linked to the Russian government targeting Ukrainian citizens with counterfeit versions of official government and news sites.
Protecting Yourself from DarkSword
Fortunately, GTIG alerted Apple about DarkSword in late 2025, leading to comprehensive patches being developed. These patches were rolled out incrementally, with the final updates included in iOS versions 26.3 and 18.7.3. Therefore, ensuring your iPhone is updated to at least one of these versions is essential for safeguarding against this malware.
Updating your iPhone is a straightforward process, and Apple allows users to update to earlier versions without needing to move to the latest iOS. Despite this, a significant number of iPhones remain on outdated versions, with 66% operating on iOS 26 and 24% on iOS 18. This means potentially millions of devices could still be vulnerable.
While the current threat landscape indicates that these attacks are primarily directed at specific regions, it's wise to take precautions. Given the simplicity of the solution--updating your device--there's little reason to leave your iPhone at risk.
