DarkSword - New iOS Exploit Tool Targets Global Users
Basically, DarkSword is a tool that hackers use to steal information from iPhones quickly.
DarkSword is a new iOS exploit kit used in attacks across multiple countries. Targeting sensitive data, it poses significant risks to users. Stay informed and protect your devices against this emerging threat.
What Happened
Lookout Threat Labs has uncovered a new iOS exploit kit named DarkSword. This toolkit has been utilized by various threat actors since late 2025 to conduct data theft campaigns. Countries like Saudi Arabia, Turkey, Malaysia, and Ukraine have been specifically targeted. DarkSword enables full-chain attacks, allowing attackers to gain complete control over iOS devices by exploiting multiple vulnerabilities.
The exploit chain relies on six vulnerabilities, three of which are zero-days. These include significant flaws such as CVE-2025-31277 and CVE-2026-20700, which have high severity ratings. This advanced toolkit is particularly dangerous as it targets iPhones running iOS versions 18.4 to 18.7, making it a serious threat to a wide range of users.
Who's Being Targeted
The primary targets of DarkSword include individuals and organizations in regions experiencing geopolitical tensions, notably Ukraine. The suspected group behind these attacks, UNC6353, is believed to have ties to Russian interests. Their operations focus on extracting sensitive data, including credentials and crypto wallet information, which can be used for financial gain.
In a concerning trend, this toolkit is not just limited to sophisticated actors. The accessibility of such advanced exploit chains on secondary markets allows less skilled hackers to launch powerful attacks. This democratization of hacking tools poses a significant risk to users worldwide.
Signs of Infection
DarkSword employs a “hit-and-run” strategy, meaning it quickly collects and exfiltrates data before erasing its tracks. Users may not notice any signs of infection, as the toolkit operates stealthily. Once the data is collected, the malware cleans up after itself, leaving minimal traces behind. This makes detection challenging for users and security systems alike.
Indicators of compromise may include unusual account activity or unauthorized transactions, particularly in crypto wallets. Users should remain vigilant and monitor their devices for any suspicious behavior, especially if they are in the targeted regions.
How to Protect Yourself
To safeguard against DarkSword and similar threats, users should ensure their devices are running the latest iOS updates, as these often contain crucial security patches. Regularly changing passwords and enabling two-factor authentication can provide an additional layer of security.
Organizations should implement robust mobile device management (MDM) solutions to monitor and protect their devices from such exploits. Educating users about the risks of clicking on unknown links or visiting compromised sites can also help mitigate the threat posed by exploit kits like DarkSword. Staying informed about emerging threats is essential in today’s rapidly evolving cybersecurity landscape.
Security Affairs