Recent reports have unveiled a sophisticated hacking technique that jeopardizes the security of iPhone users running iOS 18, particularly those on versions 18.4 to 18.6.2. Named 'DarkSword,' this hacking tool is said to be particularly dangerous, as it can compromise sensitive information merely by navigating to an infected web page.
According to information provided by Google and cybersecurity firms, vulnerabilities that DarkSword exploits had previously been addressed by Apple in its iOS updates. An Apple spokesperson confirmed that patches were released for vulnerabilities in iOS versions 15 through 26 last year. Additionally, emergency updates were made available for devices still operating on iOS 15 and 16. Users with iOS 13 or 14 are advised to upgrade to at least iOS 15 to ensure their protection, as these earlier versions were released back in 2019 and 2020.
In an effort to enhance user security, Apple has published guidance on measures users can take to safeguard their devices. The company's recommendations include regularly updating the operating system, as updates are available to shield users from the DarkSword threat, even if they are not using iOS 26. Apple also reassured users that its Safe Browsing features in Safari automatically block the URLs associated with this malware.
DarkSword distinguishes itself as a 'fileless' hack, meaning it does not install any persistent spyware on the device. Instead, it utilizes a series of exploits to gain access to sensitive data when an iPhone visits a malicious website. This technique allows it to manipulate legitimate processes within the iPhone's operating system to extract data, including personal messages and iCloud content. Alarmingly, once it has stolen the information, DarkSword erases any trace of its activity from the device.
Once an iOS device encounters an embedded malicious iframe on a web page, the hacking process initiates. DarkSword swiftly traverses the iPhone's system, gathering sensitive information, such as passwords, before self-deleting. It has been specifically reported to target cryptocurrency wallets, indicating a potential motive behind its deployment.
The use of DarkSword has reportedly been traced back to regions including Ukraine, Saudi Arabia, Malaysia, Turkey, and Russia. Its origins may be linked to another hacking toolkit dubbed Coruna, which is believed to have connections to a company named Trenchant, reportedly created for the U.S. government. The hacking tool became publicly accessible when Russian users inadvertently left its source code on a website, complete with detailed explanations and comments in English.
Apple has since released updates to iOS 26, which is the latest software version as of September 15, 2025. These updates have patched the vulnerabilities exploited by both DarkSword and Coruna. While DarkSword specifically targets iOS 18 versions 18.4 through 18.6.2, Apple has indicated that approximately 24 percent of iPhone users continue to operate on some iteration of iOS 18.
Despite the release of iOS 26, Apple also rolled out iOS 18.7 on the same date. This means that even for those hesitant to upgrade to the latest version, patches to alleviate the vulnerability are still accessible. While the percentage of vulnerable devices appears significant, the actual number of at-risk iPhones may be lower. This situation serves as a critical reminder for users to stay vigilant about software updates to maintain their device security.
Update, March 19, 2026, 11:19 AM ET: Additional details from Apple regarding proactive patches for specific iOS versions have been included in this report.
Update, March 19, 2026, 10:10 AM ET: This article has been revised to clarify that while this vulnerability primarily affects iOS 18, Apple has released secure updates for iOS 18 in the last six months.
Source: Engadget News