Overview
- Google’s security team, Lookout and iVerify identified DarkSword as a fileless iOS attack delivered through compromised legitimate websites.
- Researchers say the kit chains six flaws to leap from Safari to the kernel, enabling theft of messages, emails, passwords, browsing history and wallet data.
- The vulnerable window spans iOS 18.4 through 18.6.2, covering roughly 14% of active iPhones, with estimates reaching up to 270 million devices worldwide.
- Activity is linked to a Russia‑associated actor labeled UNC6353, with many compromised sites and victims reported in Ukraine, including media and a government server.
- Apple urged immediate updates, noting devices on iOS 18.7.3 or later are not susceptible, and iVerify is offering a free Basic tool through May to check potential exposure.