What is the DarkSword Vulnerability?

Introduction

A sophisticated and alarming hacking toolkit known as DarkSword has emerged as one of the most serious recent threats to iPhone users. Discovered through a joint investigation by Google’s Threat Intelligence Group, along with cybersecurity firms Lookout and iVerify, the toolkit has been active since at least November 2025, silently compromising iPhones and extracting vast amounts of personal data.

Rocky Cole, the cofounder and CEO of iVerify, says, “A vast number of iOS users could have all of their personal data stolen simply for visiting a popular website”. The scale of the potential impact is staggering. Rocky Cole adds, “Hundreds of millions of people who are still using older Apple devices or older operating system versions remain vulnerable”.

What makes DarkSword particularly alarming is not just its technical sophistication, but its accessibility. A more concerning issue is that portions of the toolkit have now been publicly leaked online. This leak allows virtually anyone to weaponize it against unsuspecting iPhone users.

Vulnerability Summary

DarkSword is a full-chain iOS exploit kit designed to silently infiltrate iPhones through a visit to a compromised website. The toolkit seems to chain together previous vulnerabilities to achieve complete control over a target device. The attack begins the moment a victim’s browser loads a malicious hidden iframe embedded on a compromised website.

From there, the exploit breaks out of the browser’s secure sandbox environment, pivots through the device’s GPU process, and ultimately gains deep kernel-level access to the iPhone’s operating system. DarkSword can harvest an extraordinarily wide range of sensitive information, including Wi-Fi passwords, text messages, call history, GPS location history, browser history, and much more.

Data is then silently exfiltrated to attacker-controlled servers. Michael Kan of PC Mag writes, “It’s possible hackers could use DarkSword and improve upon it. One developer in Europe claims to have used the leaked code to develop a way to hack an even wider range of software versions, from iOS 15 to iOS 26.0.1”.

How the Vulnerability Occurred and How it was Discovered

Google, IVerify, and Lookout discovered the vulnerability, a threat detection company that worked on investigating the previously discovered Coruna vulnerability. According to Lookout’s blog post, “Lookout researchers set out to analyze the malicious infrastructure associated with the Chinese and Russian threat actors who deployed the malware. While looking for additional domains tied to cdn.uacounter[.]com, the domain which Google identified as being tied to the probable Russian threat actor UNC6353, we observed a similar domain: cdncounter[.]net”.

The code lacked any meaningful concealment, which many reporters stated looked “sloppy.” This Russian threat actor UNC6353 has also been tied to the previously discovered Coruna vulnerability. They discovered this link when they noticed a domain hosted an iframe that Lookout states was “linked to cdn.uacounter[.]com, indicating that it had been used in watering hole attacks to deliver Coruna malware”. Multiple threat actors were found to be wielding the toolkit, but Lookout has deemed this to be a Russian state-sponsored espionage.

Who Is Affected

The population of affected users is broad and geographically diverse. Any iPhone running iOS versions between 18.4 and 18.7 without the latest patches falls within the vulnerable window. Lookout reports that this attack was financially motivated. Cryptocurrency exchanges were the prime target for this threat actor.

Lookout states, “exchanges targeted by DarkSword include Coinbase, Binance, Kraken, Kucoin, Okx, Mexc etc. It also targets wallets such as Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, Gnosis Safe among others”. Confirmed attack campaigns have targeted users in Ukraine, Saudi Arabia, Turkey, Malaysia, and China. Ukrainian users were targeted through compromised government and news websites.

The threat has grown significantly more indiscriminate since portions of the DarkSword code were publicly leaked and published to the code-sharing platform GitHub, where it became accessible to anyone. Security researchers from various sources confirmed that the leaked tools are essentially plug-and-play, adding that this now extends well beyond the sophisticated state-sponsored actors who originally wielded them.

Remediation Process

According to Aminu Abdullahi of TechRepublic, “Apple has already released patches in newer versions like iOS 26 and iOS 18.7.6”. The most direct remediation step for users is to update their devices immediately. Apple has also released emergency security updates for older iPhone models running iOS 15 and 16 to extend protections to users who cannot upgrade to newer operating system versions.

For users who are unable to update, Apple and security researchers strongly recommend enabling Lockdown Mode, an opt-in security feature available since iOS 16 that significantly restricts the attack surface of the device. Lockdown mode has been shown to block the techniques used by DarkSword.

Apple has also published a dedicated support page guiding users through steps to protect their devices from web-based attacks of this nature, underscoring the company’s acknowledgment of the severity of the situation.

Conclusion

DarkSword represents a critical point in the landscape of mobile security threats. What began as a covert surveillance tool rapidly evolved into a publicly accessible attack tool. The fact that it was discovered only weeks after a similar toolkit, Coruna, was discovered suggests that the mobile attack surface is growing.

Attackers are becoming more innovative and cunning than ever. For the average iPhone user, keeping software up to date is no longer a convenience but the most important defense against an increasingly hostile mobile threat environment.