A powerful new spyware campaign capable of infiltrating Apple iPhones and stealing sensitive data has been discovered embedded across dozens of websites, raising fresh concerns about the growing sophistication and scale of cyber threats worldwide. Security researchers say the exploit, known as “Darksword,” has been actively targeting users in recent weeks, particularly through compromised websites in Ukraine.
The discovery marks the second major iPhone-focused spyware detection this month, highlighting what experts describe as a rapidly expanding market for advanced hacking tools. Researchers from Google, Lookout, and iVerify conducted coordinated investigations into the malware, revealing a troubling pattern of widespread exploitation and reuse of sophisticated tools.
Darksword is designed to exploit vulnerabilities in older versions of Apple’s iOS operating system, allowing attackers to extract sensitive information, including personal data and cryptocurrency wallet details. The malware has been found targeting devices running versions of iOS released between March and August 2025, many of which remain in use due to delayed software updates by users.
Researchers estimate that between 220 million and 270 million iPhones globally may still be vulnerable, underscoring the scale of the potential threat. Although Apple has already issued patches to fix the underlying vulnerabilities, experts warn that users who fail to update their devices remain exposed.
The campaign is not limited to a single region. Investigators have linked Darksword to multiple hacking operations across countries including Saudi Arabia, Turkey, Malaysia, and Ukraine. Some of these activities have been associated with commercial surveillance vendors, including PARS Defense, although the company has not responded to inquiries.
The emergence of Darksword follows closely behind another spyware tool called Coruna, which was identified earlier this month. Researchers found both tools hosted on the same infrastructure, suggesting a shared or overlapping network of operators. This overlap has intensified concerns about the existence of an organized pipeline distributing high-end cyber weapons beyond traditional state actors.
Experts say the nature of the attacks indicates a shift in how such tools are being used. Previously, advanced iPhone exploits were typically reserved for government intelligence agencies conducting targeted surveillance. However, the widespread deployment of Darksword suggests that these capabilities are now being leveraged more broadly, including by financially motivated groups.
Cybersecurity analysts also noted that the attackers demonstrated relatively poor operational security, a factor that helped researchers uncover the exploit. This has led to speculation that the operators are less concerned about the tools being exposed, possibly because of the growing availability of similar technologies in the cybercrime ecosystem.
Apple has responded by emphasizing that the vulnerabilities exploited by Darksword have already been addressed in recent software updates. The company also confirmed that malicious domains identified in the campaign have been blocked through its Safe Browsing feature in the Safari browser, aiming to prevent further infections.
Despite these measures, the incident serves as a stark reminder of the risks posed by outdated software. Security experts stress that keeping devices updated remains the most effective defense against such attacks, particularly as cybercriminals continue to exploit known weaknesses at scale.
As digital threats evolve, the discovery of Darksword and similar tools points to a broader transformation in the cybersecurity landscape, where highly advanced exploits are no longer confined to shadowy intelligence operations but are increasingly accessible in a growing and competitive underground market.
