Malware - State-Sponsored Spyware Targeting iPhones Exposed
Basically, hackers are using a new tool to steal personal data from iPhones.
A new exploit kit named DarkSword is targeting iPhones, stealing sensitive data from users. Multiple spyware vendors, including state actors, are involved. This raises significant privacy concerns for millions of iPhone owners.
What Happened
A new exploit kit named DarkSword has emerged, targeting iPhone users and stealing sensitive information. Security researchers from Google, iVerify, and Lookout revealed that this malware has been in use since at least November 2025. It exploits six vulnerabilities in iOS versions 18.4 through 18.7 to deploy multiple backdoors. These backdoors can extract personal data such as messages, recordings, and location history.
This is not an isolated incident; it's the second exploit kit discovered in a month. The first, Coruna, was also linked to various criminal groups. The use of DarkSword highlights a troubling trend where both state-sponsored actors and commercial spyware vendors are targeting iPhone users for espionage and financial theft.
How It Works
The DarkSword exploit chain is initiated when a user visits a malicious website. Attackers exploit vulnerabilities like CVE-2025-31277 or CVE-2025-43529 to gain remote code execution. Once inside, they bypass security measures to achieve arbitrary code execution. This allows them to manipulate the iPhone's processes and ultimately extract sensitive data.
The exploit utilizes multiple vulnerabilities, including CVE-2026-20700, which helps attackers escape the sandbox environment. The final stage involves privilege escalation through CVE-2025-43520, allowing the injection of malicious scripts into system processes. This sophisticated method makes it difficult for users to detect the malware.
Who's Using DarkSword to Spy on iPhone Users?
Multiple groups are reportedly using DarkSword for their operations. One such group, identified as UNC6748, has targeted users in Saudi Arabia using a Snapchat-themed website. Their attacks deployed a JavaScript backdoor named GhostKnife, which steals various types of data, including messages and location.
Another group, UNC6353, has been observed using DarkSword in campaigns against Ukrainian users. They deploy a backdoor called GhostBlade, which collects extensive data from compromised devices. These activities underline the growing threat posed by both state actors and commercial surveillance vendors in the digital landscape.
What You Should Do
To protect yourself from these threats, ensure that your iPhone is updated to the latest iOS version. Apple has patched the vulnerabilities exploited by DarkSword, so regular updates are crucial. Be cautious of suspicious links and websites, as these are often the entry points for such malware.
Additionally, consider using security tools that can help detect and block malicious activities. Awareness of these threats is the first step in safeguarding your personal data against sophisticated spyware campaigns.
The Register Security