A new spyware has been discovered, one that specifically targets iPhones. As per research reports, this new spyware, called DarkSword, can instantly hack and steal data from vulnerable devices, and is likely capable of penetrating millions of iPhones.
Cybersecurity firms Lookout and iVerify, along with Alphabet’s Google, jointly analysed the malware. Researchers across the three organisations have released notes on DarkSword.
Researchers estimate that between 220 million and 270 million iPhones may still be vulnerable to DarkSword due to running outdated iOS versions. Here is everything you need to know about this spyware.
What is DarkSword?
According to researchers, DarkSword was found embedded across multiple legitimate Ukrainian websites. It exploits iPhones running iOS versions 18.4 to 18.6.2 with “elegant techniques never publicly seen before.”
Once a user visits the infected site, the spyware can instantly and silently hack their device. This allows the spyware to gather information such as Wi-Fi passwords, text messages, call history, root location history, browser history etc.
One of the impacted websites was said to have a “.gov.ua” address, indicating that the hackers were able to compromise Ukrainian government servers. And Ukrainian websites may not be the only ones compromised.
Google reported that multiple commercial vendors and suspected state-linked hacking groups have used DarkSword in separate campaigns targeting users in Saudi Arabia, Turkey, Malaysia and Ukraine. The operations in Malaysia and Turkey were linked to Turkish commercial surveillance firm PARS Defense.
Who made DarkSword?
Researchers note that DarkSword is hosted on the same servers as the Coruna spyware that was found targeting users in Ukraine on March 3, 2026. Though Coruna was used largely for crypto theft.
iVerify claims that the infrastructure was likely run by a threat actor from Russia. Russia has been at war with Ukraine since invading the country in February 2022.
Though the real identity of the hackers remains unknown.
Is my iPhone safe?
DarkSword leverages vulnerabilities in iOS versions released between March and August 2025. Since then, Apple has released several patches addressing these exploits. However, it is believed that around 220 million and 270 million users may still have their iPhones on older iOS versions, making them vulnerable.
An Apple spokesperson told Reuters, “Keeping software up to date remains the single most important thing users can do to maintain the high security of their Apple devices.”
The spokesperson also stated that Apple Safe Browsing blocks all malicious domains identified by Google in its Safari web browser to prevent further exploitation.
Growing attacks on iPhones
iPhones are known for being more private and secure compared to other operating systems like Android. However, hackers have now targeted iPhones with two powerful iOS exploits in the same month, potentially signalling a large-scale ecosystem. Researchers believe that such an ecosystem was previously limited mostly to state-level intelligence operations.
However, iVerify chief Rocky Cole stated that these attacks were not the same as state-linked operations, since the hackers were not afraid of having these vulnerabilities get discovered. Cole said, “The fact that they don’t care if it gets burned, and that they’re using them in mass attacks with poor (operational security)… They’re not overly precious about them being exposed.”
