Leaked DarkSword Kit Targets iOS Vulnerabilities

Cybersecurity researchers have uncovered a significant escalation in threats to iPhone users after a sophisticated exploit kit known as DarkSword was leaked online, potentially exposing millions of devices to widespread hacking attempts. The leak, reported last week on a public code-sharing platform, democratizes access to tools previously limited to advanced threat actors, including nation-state groups and surveillance vendors. DarkSword targets vulnerabilities in iOS versions 18.4 through 18.7, affecting iPhones and iPads that have not received recent security updates.

The exploit kit, first identified by researchers at Lookout in mid-March 2026, enables attackers to bypass Apple's security protections and extract sensitive data, such as credentials from cryptocurrency wallets and other personal information. According to Google's Threat Intelligence Group, DarkSword has been active since at least November 2025 and relies on six patched vulnerabilities, including CVE-2025-31277 for sandbox escape and CVE-2025-43529 for privilege escalation. These flaws allow remote code execution with minimal user interaction, often through malicious websites or links.