TL;DR: 270 Million Vulnerable iPhones
Impact: DarkSword has been active since November 2025 — 4+ months before disclosure. At least 4 threat actor groups (Russian SVR, commercial spyware vendors) deployed it against journalists, activists, executives, and government officials. Patch: iOS 18.7.5.
What Happened: A Zero-Click iPhone Hack in the Wild
On March 18, 2026, Google GTIG, iVerify, and Lookout jointly disclosed DarkSword — a sophisticated iOS exploit kit capable of completely compromising iPhones running iOS 18 with no user interaction beyond visiting a website.
The attack is devastatingly simple from the victim's perspective: visit a compromised website in Safari. Nothing looks wrong. No prompts. No downloads. Yet within seconds, DarkSword has chained six vulnerabilities, escaped the browser sandbox, escalated to kernel privileges, and deployed a full-featured infostealer.
WIRED's investigation found DarkSword appears to be built on a toolkit originally developed by or for a US government intelligence contractor — a pattern echoing EternalBlue and NSO Group. The intelligence community is calling it a "major operational security failure."
The Six-Stage Exploit Chain
DarkSword's sophistication lies in the precise sequencing of six distinct exploits that together transform a website visit into complete device ownership.
Memory corruption in JavaScriptCore (Safari's JS runtime). Crafted JavaScript triggers the bug, giving attackers code execution inside the WebKit/Safari renderer process — no interaction needed.
An unpatched zero-day in the iOS GPU driver escapes the App Sandbox. GPU drivers are historically vulnerable because low-level hardware access inherently weakens isolation boundaries.
Belt-and-suspenders: a second zero-day in the iOS dynamic linker (dyld) ensures sandbox escape even if the GPU path is blocked. Redundancy signals nation-state-grade engineering.
A third zero-day in the iOS kernel itself escalates from user-space to kernel privileges. Code signing bypassed. MDM monitoring defeated. Every file, process, and memory location accessible.
Known vulnerability (exploited before patch availability) used for payload deployment and surviving partial device restores.
Final stage hardens the implant against detection tools and MDM compliance checks. Devices appear compliant to enterprise MDM while fully compromised.
The Russian Connection & the Leaked Toolkit
SecurityWeek confirmed the Russian APT behind DarkSword is the same actor responsible for "Coruna" — a separate iOS exploit targeting Ukrainian officials in late 2025. This group is assessed to be SVR (Russia's Foreign Intelligence Service) or a closely affiliated contractor.
Google GTIG confirmed at least two commercial surveillance vendors have integrated DarkSword capabilities into their products. These vendors sell to law enforcement and intelligence agencies worldwide — meaning the exploit has effectively proliferated to dozens of governments. iVerify estimates the campaign hit tens of thousands of devices, concentrated in Eastern Europe, the Middle East, and among journalists and executives in Western countries.
Why iOS Wasn't as Secure as Apple Claimed
Apple markets iOS as the world's most secure mobile platform. For most users against commodity threats, this is practically true. But DarkSword illustrates the gap between "secure against most attackers" and "secure against nation-states with multi-million-dollar exploit budgets."
Apple's App Store model prevents unapproved app installations — but does nothing against browser exploits. Worse: Apple requires every iOS browser (Safari, Chrome, Firefox) to use WebKit as its engine. One WebKit zero-day = every browser on every iPhone simultaneously vulnerable.
DarkSword's kernel-level access lets it bypass and manipulate MDM controls. Organizations using MDM to monitor employee iPhones may have received false "compliant" signals for fully compromised devices. This is a systemic assumption failure in enterprise mobile security.
Apple released iOS 18.7.5 on disclosure day (March 18). But as of March 20, only ~15-20% of eligible devices have updated — leaving 200M+ iPhones still exposed to a publicly disclosed, actively exploited attack chain.
How to Protect Your iPhone and Your Organization
# Settings → General → Software Update # This patches all 6 DarkSword vulnerabilities # If on iOS 26 beta → update to 26.3 # Every minute unpatched = open attack surface
# Settings → Privacy & Security → Lockdown Mode # Journalists, activists, executives, legal/finance teams # Significantly limits WebKit attack surface # Reduces some functionality — worth it for targeted individuals
# Require iOS 18.7.5+ within 48-72h via MDM # Devices on vulnerable iOS → revoke corp resource access # Cross-reference MDM compliance with iVerify # DarkSword can SPOOF MDM compliance status
# DarkSword specifically targets seed phrases # If iPhone accessed crypto apps Nov 2025 – Mar 18, 2026 # AND device was not on latest iOS throughout: # → Assume seed phrases COMPROMISED → rotate to new wallet
# Deploy iVerify or similar for device integrity checks # Apple default MDM tools DON'T detect kernel compromise # Target: executives, legal, finance, comms, IT admins # Look for DarkSword IoCs in Nov 2025 – Mar 18 window
Impact: Geographic & Product Scope
Known Victim Distribution
Affected Products
Attack & Disclosure Timeline
Google GTIG detects first DarkSword activity; targets concentrated in Ukraine and Eastern Europe
DarkSword proliferates to commercial spyware vendors and additional state actors; attacks expand globally
WIRED reports "possible US government iPhone-hacking toolkit" is now in foreign hands — foreshadowing the disclosure
Joint disclosure by Google GTIG, iVerify, and Lookout; Apple releases iOS 18.7.5 patching all 6 vulnerabilities
Apple issues urgent advisory; NBC News reports mass hacking campaigns targeting journalists and executives
WIRED, SecurityWeek, Mashable, Time confirm 270M vulnerable iPhones; multiple CERTs issue emergency advisories
References
Concerned About Mobile Threats in Your Organization?
DarkSword targets executives, legal, finance, and communications teams — exactly the people with access to your most sensitive data. Get a mobile security assessment before the next zero-day campaign hits.
This research was compiled for defensive purposes. Update your iPhone.