A coordinated investigation by Google's Threat Intelligence Group, Lookout Threat Labs, and iVerify has exposed DarkSword — the most dangerous iPhone exploit kit discovered in years. Unlike previous iOS attacks that targeted journalists and activists, DarkSword is designed for mass exploitation. Up to 296 million iPhones may be vulnerable.
Here's everything you need to know — and exactly what to do right now.
What Is DarkSword?
DarkSword is a full-chain, zero-click iOS exploit kit that chains six separate vulnerabilities to achieve complete control of an iPhone. The attack requires no interaction from the victim — simply visiting a compromised website is enough.
Once inside, the malware deploys three JavaScript-based payloads — codenamed GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER — that exfiltrate your data in seconds before deleting themselves to avoid detection.
What DarkSword Steals
The exploit targets virtually everything on your iPhone:
- **Photos and videos** — full camera roll access
- **Passwords** — saved credentials and keychain data
- **Crypto wallets** — targets 12+ exchanges (Coinbase, Binance, Kraken) and 7+ wallet apps (Ledger, MetaMask, Trezor)
- **Messages** — iMessage, Telegram, WhatsApp, Signal
- **Location history** — complete movement tracking
- **Health data** — Apple Health records
- **Browser history** — Safari and Chrome data
- **iCloud Drive** — documents and files
- **Wi-Fi passwords** — saved network credentials
Who's Behind the Attacks?
Three distinct threat actors have been identified using DarkSword since November 2025:
| Threat Actor | Suspected Origin | Target Region | Attack Method |
|---|---|---|---|
| UNC6353 | Russia-linked | Ukraine | Compromised government and news sites |
| PARS Defense | Turkey (commercial vendor) | Turkey, Malaysia | Surveillance-as-a-service clients |
| UNC6748 | Commercial surveillance | Saudi Arabia | Fake Snapchat-themed watering hole |
Is Your iPhone Vulnerable?
DarkSword targets iPhones running iOS 18.4 through 18.7. If your iPhone is on any of these versions, you are vulnerable.
To check your iOS version: go to Settings → General → About and look at the "iOS Version" field.
How to Protect Your iPhone Right Now
Step 1: Update iOS immediately
- Open Settings → General → Software Update
- Install the latest available update (iOS 26.3 patches all DarkSword vulnerabilities)
- Turn on Automatic Updates if not already enabled
Apple has also released backported patches for legacy devices:
- iOS 15 devices received patches on March 11, 2026
- iOS 16 devices received patches on March 11, 2026
- Devices stuck on iOS 13 or 14 must upgrade to iOS 15 to receive protection
Step 2: Enable Lockdown Mode (high-risk users)
If you cannot update immediately, Apple's Lockdown Mode blocks DarkSword even on unpatched software:
- Go to Settings → Privacy & Security → Lockdown Mode
- Tap Turn On Lockdown Mode
- Restart your device
- Completely blocks DarkSword exploit chain
- Works even on unpatched iOS versions
- No cost — built into iOS 16+
- Disables some website features and attachments
- Blocks FaceTime from unknown callers
- Some apps may not function normally
Step 3: Additional security hardening
- Enable two-factor authentication for your Apple ID (Settings → [Your Name] → Sign-In & Security)
- Turn on Advanced Data Protection for iCloud (Settings → [Your Name] → iCloud → Advanced Data Protection)
- Review app permissions — revoke location, microphone, and camera access for apps that don't need it
- Avoid public Wi-Fi without a VPN — or use iCloud Private Relay
- Check for signs of compromise — unusual battery drain, overheating, or unfamiliar network activity
Timeline: How DarkSword Unfolded
Why DarkSword Changes Everything
Previous iPhone exploits like Pegasus were precision weapons — expensive, used against specific high-value targets. DarkSword represents something far more dangerous: the industrialization of mobile spyware.
Security researchers found that parts of DarkSword's code show evidence of Large Language Model assistance, allowing rapid development and professional-grade documentation. The exploit kit was found sitting openly on compromised servers, so neatly documented that any hacker could copy and redeploy it.
What Happens Next
Security analysts expect three developments in the coming weeks:
- A race against time — now that DarkSword is publicly documented, unpatched iPhones face even greater risk as more actors adopt the technique
- Regulatory pressure — the involvement of commercial surveillance vendors like PARS Defense will fuel calls for stricter spyware-industry regulation internationally
- AI-powered exploits — the confirmed use of LLMs in DarkSword's development signals a new era where AI dramatically lowers the cost of creating zero-day exploit chains
The bottom line: if you own an iPhone, update it today. Not tomorrow. Today.
