DarkSword iPhone hack
A newly exposed iPhone spyware tool called “DarkSword” reportedly chains multiple zero‑day flaws to extract data and evade normal defenses—security experts called it “extremely worrisome.” Apple has responded by backporting iOS 26.x security patches to iOS 18 and publishing updated security content for iOS 26.4 as part of the emergency response. (cnet.com) (wired.com) (support.apple.com)
Google’s Threat Intelligence Group says DarkSword was observed in use since November 2025 by multiple commercial surveillance vendors and suspected state‑sponsored actors against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine. (cloud.google.com) Researchers report DarkSword targets iOS 18.4–18.7 and, after exploitation, deploys three distinct malware families named GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER that rapidly exfiltrate credentials and cryptocurrency wallet data using a “hit‑and‑run” pattern, per Lookout and GTIG analyses. (cloud.google.com) A newer version of DarkSword was posted to GitHub on March 23, 2026, and security firms including iVerify warned the leaked files “will work out of the box,” a release that researchers say makes the toolkit trivially reproducible by lower‑skill actors. (techcrunch.com) Industry estimates place roughly 220 million to 270 million iPhones on the vulnerable iOS 18 builds targeted by DarkSword, a range derived from public telemetry and market‑share analyses cited by multiple research teams. (techspot.com) Apple addressed a critical WebKit navigation cross‑origin flaw tracked as CVE‑2026‑20643 through Background Security Improvements delivered in iOS 26.3.1 and related updates, with the issue documented in the NVD vulnerability record. (thehackernews.com) Google said it added DarkSword delivery domains to Safe Browsing, and Apple’s iOS 26.4 security notes list more than 35 fixes across WebKit and other components that researchers tied to exploitation chains like DarkSword. (cloud.google.com)
