Cybersecurity researchers from Lookout, iVerify and Google have identified a sophisticated spyware tool, named «Darksword,» capable of infiltrating Apple iPhones and stealing sensitive data, including cryptocurrency wallet information, Reuters reported.
The finding follows another recent case of iPhone spyware, highlighting a growing market for advanced hacking tools targeting Apple devices. Earlier this month, Google and iVerify reported a separate spyware tool called «Coruna,» with Darksword later found to be hosted on the same servers.
According to Google, Darksword has been used in multiple campaigns by commercial vendors and suspected state-linked actors, targeting users in Saudi Arabia, Turkey, Malaysia and Ukraine.
Researchers said the malware affected iPhones running iOS versions 18.4 through 18.6.2, released between March and August 2025 and was distributed via compromised Ukrainian websites. Apple has since issued updates to address the vulnerabilities, but many devices remain at risk due to outdated software. Estimates suggest that between 220 million and 270 million iPhones may still be running affected versions.
Apple said the exploits primarily affected devices that had not been updated and emphasized that installing the latest software remains the most effective way to maintain security. The company also said it has blocked the malicious domains through Safari’s Safe Browsing feature.
