DarkSword: A New Threat to iPhone Security

Recent cybersecurity reports have unveiled a sophisticated exploit chain known as DarkSword, which targets iPhones running outdated versions of iOS, specifically versions 18.4 through 18.7. This exploit has been linked to multiple threat actors, including suspected Russian state-sponsored groups, and has been deployed in campaigns against users in Saudi Arabia, Turkey, Malaysia, and Ukraine since at least November 2025. DarkSword operates through compromised websites, allowing attackers to infiltrate devices simply by visiting these sites, a method known as a "watering-hole" attack.

DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover

DarkSword is notable for its use of multiple vulnerabilities to achieve a full kernel-level compromise. It exploits six known vulnerabilities, including CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, and CVE-2025-43520. The exploit chain is designed to execute JavaScript that can escalate privileges, escape browser sandboxes, and ultimately access sensitive data stored on the device. The malware can extract a wide range of information, including SMS messages, call logs, photos, and cryptocurrency wallet data.

DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device TakeoverTom's GuideDarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike9to5Mac

Estimates suggest that between 220 million to 270 million iPhones may still be vulnerable to DarkSword due to users running outdated software. This vulnerability is exacerbated by the fact that many users do not regularly update their devices, leaving them exposed to such sophisticated attacks. The ease of access to these exploits has raised concerns among cybersecurity experts about the growing market for mobile spyware, which was once primarily the domain of state actors.

Sky NewsCNETResearchers discover iPhone spyware that can infiltrate millions of devicesNBC NewsApple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks

In response to the emergence of DarkSword, Apple has urged users to update their devices to the latest iOS versions, which include patches for the vulnerabilities exploited by DarkSword. Apple spokesperson Sarah O’Rourke emphasized that keeping software up to date is crucial for maintaining device security. For users unable to upgrade to the latest iOS, Apple has released emergency updates for older versions, specifically targeting those running iOS 15 and 16.

EngadgetUpdate your iPhone now: Apple warns users as Google uncovers Russian-linked ‘DarkSword’ spyware threatApple Details Response To DarkSword iPhone Spyware9to5MacThe HillCNET

Despite Apple's efforts to mitigate the risks associated with DarkSword, experts warn that the proliferation of such exploits indicates a shift in the landscape of mobile security. Rocky Cole, COO of iVerify, noted that the perception of iPhones as secure devices is outdated, as the barriers to entry for widespread mobile attacks have significantly lowered. The dual-use nature of DarkSword, which targets both espionage and financial theft, raises further concerns about the motivations of the actors involved.

DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike

• “Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices,” — Sarah O’Rourke, Apple Spokesperson

NBC News

• “The scary takeaway for regular users is they can’t spot this attack,” — John Scott-Railton, Senior Researcher at Citizen Lab

NBC News

As the threat landscape evolves, ongoing monitoring and rapid response to emerging vulnerabilities will be essential. Users are advised to enable Lockdown Mode if they are at elevated risk and to remain vigilant about software updates. The situation underscores the need for heightened awareness regarding mobile security and the importance of maintaining up-to-date software to protect against sophisticated cyber threats like DarkSword.