New 'DarkSword' Spyware Threatens Millions of iPhones Globally

A significant cybersecurity threat, dubbed 'DarkSword' spyware, has emerged, putting millions of iPhone users worldwide at risk. Discovered by researchers from Google, Lookout, and iVerify, this sophisticated malware exploits vulnerabilities in older versions of Apple's iOS, specifically versions 18.4 through 18.7, to steal sensitive personal and financial data. The exploit chain chains together six different vulnerabilities, allowing attackers to gain extensive access to a compromised device. The primary concern with DarkSword is its 'watering hole' attack method. Unlike traditional malware that requires users to download files or click on suspicious links, DarkSword can infect an iPhone simply by the user visiting a compromised website. These compromised sites can range from legitimate news portals and government pages to e-commerce and industrial equipment sites, making it difficult for users to discern a threat. Once a vulnerable device visits such a site, the spyware can exfiltrate a wide range of sensitive information, including Wi-Fi passwords, text messages (from apps like iMessage, WhatsApp, and Telegram), call history, location history, browser history, cryptocurrency wallet credentials, photos, and data from apps like Calendar and Notes. Researchers estimate that approximately 220 million to 270 million iPhones could be vulnerable, based on the number of devices still running older iOS versions. The DarkSword exploit has been observed in targeted campaigns in various countries, including Ukraine, China, Saudi Arabia, Turkey, and Malaysia. While initial reports did not mention American targets, the global reach of such tools is a growing concern. Although Apple has acknowledged the threat and released security updates to patch the underlying vulnerabilities, the continued use of older iOS versions by a significant portion of users leaves them exposed. Apple's latest security updates, including iOS 26.4, aim to address these issues. Security experts emphasize that the most crucial step for users is to update their devices to the latest available iOS version to protect themselves from DarkSword and similar threats. Furthermore, Apple's 'Lockdown Mode,' introduced in 2022, offers an advanced layer of protection for high-risk users, and Apple states it has not yet been successfully breached by sophisticated spyware. The proliferation of such sophisticated spyware tools, once seemingly exclusive to government intelligence, now being available to cybercriminals, signifies a concerning trend. The discovery of DarkSword, along with another spyware called 'Coruna' found on similar infrastructure, highlights the evolving landscape of cyber threats and the ongoing need for user vigilance and prompt software updates. The news is relevant to India as Apple has previously issued threat notifications to users in India regarding mercenary spyware attacks, including instances before major elections. While DarkSword's specific impact on India is not detailed in these reports, the global nature of the threat means Indian iPhone users are also at risk if they are running older iOS versions and have not updated their devices. The Indian Computer Emergency Response Team (Cert-In) has also previously flagged security vulnerabilities in Apple devices, further underscoring the need for Indian users to stay informed and protected.

Frequently Asked Questions

Read Full Story on Quick Digest