iOS hacking instrument ‘DarkSword’ leaked on GitHub

DarkSword is much like Coruna, which targets iPhone fashions working iOS variations from 13.0 as much as 17.2.1.

A serious iOS exploit equipment unveiled by cybersecurity consultants earlier this month has been leaked on GitHub, additional rising vulnerabilities for older iPhones and iPads.

In a joint investigation this month, Google Menace Intelligence Group (GTIC) and iVerify unveiled ‘DarkSword’, a brand new full-chain exploit that targets iOS variations 18.4 by way of 18.7. It’s seemingly that tens of millions of customers globally use older Apple merchandise that this exploit might have an effect on.

Since at the very least November 2025, DarkSword has been utilized by a number of industrial surveillance and suspected state-sponsored actors to focus on customers in Saudi Arabia, Turkey, Malaysia and Ukraine, finds GTIC.

These assaults used a number of vulnerabilities in Apple’s working system to achieve entry to delicate data from the customers’ gadgets.

GITC has recognized hackers leveraging a Snapchat-themed faux web site to focus on Saudi Arabian customers. Whereas in addition they noticed DarkSword utilized in Turkey, as effectively by suspected a Russian espionage actor leveraging the exploit to focus on Ukrainian customers.

The group stated that they reported these DarkSword vulnerabilities to Apple late final 12 months, and these have all since been patched with the discharge of iOS 26.3. Nonetheless, yesterday (23 March), TechCrunch reported {that a} newer model of DarkSword was leaked on the code-sharing web site GitHub.

Talking to the publication, iVerify co-founder Matthias Frielingsdorf stated that these exploits are “manner too straightforward to repurpose”. “I don’t suppose that may be contained anymore. So we have to count on criminals and others to start out deploying this.”

DarkSword is much like ‘Coruna’, an exploit the staff unveiled earlier this month. Coruna targets iPhone fashions working iOS variations from 13.0 as much as 17.2.1.

The exploit equipment infects outdated iPhones visiting sure web sites. It doesn’t include any particular concentrating on or one-time hyperlinks that means anybody who visited such a web site whereas working a weak iOS model might get contaminated, and in addition get re-infected a number of instances.

GITC and iVerify say that the usage of each DarkSword and Coruna by a wide range of actors demonstrates the continuing danger of exploit proliferation throughout actors with completely different objectives throughout the globe.

It is suggested that customers replace their gadgets to the newest model of iOS. In circumstances of older fashions the place updates aren’t potential, it’s suggested that customers allow ‘Lockdown Mode’ for enhanced safety.

Don’t miss out on the information you should succeed. Join the Every day Temporary, Silicon Republic’s digest of need-to-know sci-tech information.