Security researchers from iVerify, Lookout and Google’s Threat Intelligence Group (GTIG) have said that they have uncovered a sophisticated new hacking tool capable of stealing personal data from iPhones, and that some of the users are at a risk.
The exploit kit, named Darksword, has been discovered by researchers at Lookout Threat Labs while investigating a separate but related hacking operation. Google’s Threat Intelligence Group and mobile security firm iVerify also collaborated on the analysis – making this one of the most comprehensive investigations into a previously unknown iOS threat.
What is Darksword and why it is dangerous
According to the reports, Darksword is a professionally designed, highly sophisticated platform that appears to have been built for future development and shows clear signs of deliberate engineering for maintainability.
Security researchers call Darksword an exploit kit that has tools designed to take advantage of vulnerabilities in software, in this case Apple’s iOS. It targets iPhones running iOS 18.4 through iOS 18.6.2. The group behind Darksword is tracked by researchers under the identifier UNC6353 and a definitive attribution remains unclear. Moreover, researchers say that there are signs that large language model (LLM) tools – which power AI chatbots – have been used to extend Darksword’s functionality.
“This malware is highly sophisticated and appears to be a professionally designed platform enabling rapid development of modules through access to a high level programming language,” Lookout noted in its report, adding that “this extra step shows a significant effort put into the development of this malware with thoughts about maintainability, long-term development and extensibility.”
How does the attack work and what data can hackers steal
Researcher explain that the attack begins in Safari, Apple’s default web browser on iPhones.
Users do not need to download anything suspicious or click on any link – simply visiting a compromised website may be enough.Researchers claim that the threat actors had gained sufficient access to inject malicious code into the HTML of legitimate websites. Darksword uses a chain of vulnerabilities to gain deep read and write access to the iPhone’s core operating system. From there, a central component takes over, eventually taking over the phone.
Data-stealing modules are then activated, and the harvest begins.According to Lookout’s analysis (via The Bleeping Computer), the information Darksword targets includes the following:
- Saved passwords
- Photos, including screenshots and hidden image files
- WhatsApp and Telegram databases
- Cryptocurrency wallets (Coinbase, Binance, Ledger, and others)
- Text messages (SMS)
- Address book
- Call history
- Location history
- Browser history
- Cookies
- Wi-Fi history and passwords
- Apple Health data
- Calendar
- Notes
- Installed applications
- Connected accounts
Notably, Darksword wipes temporary files and exits when the data is stolen.
Who is at risk and what iPhone users must do
The good news is that Apple has already fixed the vulnerabilities in its latest iOS releases. This means that if your iPhone is fully up to date, you are protected. Those who are not, it is recommended to upgrade to iOS 26.3.1 (latest), released earlier this month. They can also enable Lockdown Mode if at high risk of being targeted by malware.
- To update iOS: Go to Settings → General → Software Update.
- To enable Lockdown Mode: Settings → Privacy & Security → Lockdown Mode.
Older iPhones that are no longer eligible for the latest iOS version may still receive targeted security fixes.
