Trending Now - Apple Urges Iphone Users to Update Amid New Hacking Threats
WHO:
The hacking group known as UNC6353 has been linked to the use of DarkSword in attacks targeting Ukrainian users.
The Google Threat Intelligence Group, along with cybersecurity firms Lookout and iVerify, conducted the analysis of the DarkSword exploit.
The hacker group known as UNC6748 has been linked to the use of DarkSword in attacks targeting Saudi Arabian users in November 2025.
The Turkish commercial surveillance vendor PARS Defense has also utilized DarkSword in November 2025.
Security researchers, Google Threat Intelligence Group, cybersecurity firms Lookout and iVerify, Apple, Sarah O’Rourke (Apple spokesperson), Russian hackers.
WHAT:
DarkSword has been reported to exploit three additional vulnerabilities: CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520.
The exploit chain is designed to target iPhones running iOS versions between 18.4 and 18.7, with a focus on the vulnerabilities that were patched in iOS 26.3 and 18.7.3.
Apple has confirmed that it issued an emergency update for devices running iOS 15 and 16 that are unable to run newer versions of iOS.
DarkSword has been confirmed to exploit three zero-day vulnerabilities: CVE-2026-20700, CVE-2025-43529, and CVE-2025-14174.
The exploit chain is designed to target iPhones running iOS versions between 18.4 and 18.7.
DarkSword is capable of extracting a wide range of personal information, including emails, iCloud Drive files, contacts, SMS messages, Safari browsing history, and cryptocurrency wallet data.
DarkSword is reported to exploit six different vulnerabilities targeting Safari on iPhones running iOS 18.4 through 18.6.2.
The spyware can collect a wide range of data, including iMessage data, email, WhatsApp data, Telegram data, and cryptocurrency wallet credentials.
The dwell time of DarkSword on the device is likely in the range of minutes, depending on the amount of data it discovers and exfiltrates.
Hackers utilizing DarkSword have left the code behind for others to access and deploy, indicating a lack of concern for its discovery.
DarkSword targets iPhones running iOS versions 18.4 through 18.7.
Nearly 25 percent of all iPhones are still on some version of iOS 18, indicating potentially hundreds of millions of devices are susceptible to DarkSword.
DarkSword can siphon data including call logs, calendars, notes, screenshots, web browser history, signed-in account identities, device keychains, SIM card info, Find My Phone settings, and WiFi passwords.
The spyware is designed to collect and exfiltrate data quickly, with a dwell time on the device likely in the range of minutes.
An early incident in November targeted Saudi Arabian users through a Snapchat-themed website called Snapshare.
Recent attacks in March 2026 targeted iPhone users in Ukraine through compromised legitimate Ukrainian news sites and official government websites.
The hacker group suspected to be behind these attacks is known as UNC6353.
A new hacking tool called "DarkSword" targets iPhones running iOS 18.4 to 18.6.2.
DarkSword allows hackers to collect personal information from iPhones visiting malicious links.
Up to 270 million devices are affected by the vulnerabilities.
DarkSword exploits six different vulnerabilities targeting Safari.
The attack can collect text messages, contacts, saved credentials, iCloud files, photos, cryptocurrency wallets, call logs, and location history.
Apple confirmed that all underlying vulnerabilities were patched last year and issued an emergency software update last week for older devices.
WHERE:
Recent attacks in March 2026 targeted iPhone users in Ukraine through compromised legitimate Ukrainian news sites and official government websites.
The attacks have targeted users in Ukraine, Saudi Arabia, Malaysia, and Turkey.
WHEN:
Google reported the vulnerability to Apple in late 2025, and Apple issued an emergency software update on March 12th, 2026.
DarkSword has been in use since at least November 2025.
Google reported the vulnerability to Apple in late 2025.
An emergency software update was issued by Apple on March 12th, 2026.
WHY:
The lack of obfuscation in DarkSword's code suggests that the hackers may not have access to strong engineering resources or are not concerned with operational security measures.
The hackers are likely confident in replicating new and similar attacks with new tools, as they have left the DarkSword code easily accessible.
The hackers utilizing DarkSword are likely confident in replicating new and similar attacks with new tools, as they have left the code behind for others to access and deploy.
The hacking tool is used by Russian state-sponsored hackers to target specific users.
HOW:
DarkSword uses a JavaScript-based exploit chain that leverages multiple vulnerabilities to establish privileged code execution and access sensitive information, including a method that allows it to escape the WebContent sandbox and access restricted parts of the file system.
DarkSword uses a JavaScript-based exploit chain that leverages multiple vulnerabilities to establish privileged code execution and access sensitive information.
The attack begins when a user visits a compromised website that embeds an iFrame containing JavaScript, which then executes the exploit chain.
DarkSword uses a "hit-and-run" design that allows attackers to extract high-value data quickly and disappear before detection methods can respond.
DarkSword uses a "hit-and-run" design to extract high-value data quickly.
Google, Lookout, and iVerify found that the attack does not impact users in Lockdown Mode, an extreme security feature for iPhones.
Apple and Google have blocked the malicious links used in DarkSword attacks in Safari and Chrome.
(UPDATED March 19, 2026 23:07 UTC)
In a significant cybersecurity development, the hacking group UNC6353 has been linked to the use of a malicious tool called DarkSword, which targets Ukrainian users. This exploit has been found to leverage three additional vulnerabilities affecting iPhones running iOS versions between 18.4 and 18.7, prompting Apple to issue an emergency update on March 12 for devices unable to run newer iOS versions. The analysis conducted by the Google Threat Intelligence Group, along with cybersecurity firms Lookout and iVerify, revealed that DarkSword employs a JavaScript-based exploit chain to gain privileged access and extract sensitive information.
--
(UPDATED March 19, 2026 17:21 UTC)
In a significant cybersecurity development, the hacker group UNC6748 has been linked to the use of a malicious tool called DarkSword, which has targeted Saudi Arabian users since November 2025. DarkSword exploits three zero-day vulnerabilities to access sensitive information from iPhones running specific iOS versions, including emails, contacts, and cryptocurrency wallet data, all initiated when users visit compromised websites. The tool's lack of obfuscation in its code raises concerns about the hackers' resources or their disregard for operational security measures.
--
(UPDATED March 19, 2026 09:09 UTC)
Today, reports have emerged that a spyware known as DarkSword is exploiting six vulnerabilities in Safari on iPhones running iOS versions 18.4 through 18.6.2, particularly targeting users in Ukraine through compromised news and government websites. This spyware can collect a variety of sensitive information, including iMessage and WhatsApp data, and its design allows hackers to extract valuable data quickly before detection. Alarmingly, the code for DarkSword has been left accessible by the hackers, suggesting they are confident in their ability to replicate these attacks with new tools.
--
(UPDATED March 19, 2026 07:18 UTC)
Today, a significant cybersecurity threat has emerged as the hacker group UNC6353 is targeting iPhones running iOS versions 18.4 through 18.7, affecting nearly 25 percent of all iPhones, which could mean hundreds of millions of devices are at risk. This spyware, known as DarkSword, can quickly siphon sensitive data such as call logs, web browser history, and WiFi passwords, with a dwell time on the device likely lasting just minutes. Recent attacks have specifically targeted iPhone users in Ukraine through compromised news and government websites, following an earlier incident in November that affected Saudi Arabian users via a Snapchat-themed site.
--
(UPDATED March 19, 2026 01:27 UTC)
Security researchers from Google, along with cybersecurity firms Lookout and iVerify, have uncovered a new hacking tool called "DarkSword" that targets iPhones running iOS versions 18.4 to 18.6.2, potentially affecting up to 270 million devices. This tool, used by Russian state-sponsored hackers, exploits six vulnerabilities in Safari to collect sensitive personal information like text messages, contacts, and location history from users in countries including Ukraine, Saudi Arabia, Malaysia, and Turkey. Apple confirmed that all underlying vulnerabilities were patched last year and issued an emergency software update on March 12, 2026, while also blocking the malicious links associated with DarkSword in both Safari and Chrome.