Apple is warning users that older iPhones running outdated software are at risk from powerful web based exploit kits like DarkSword and Coruna.
Quick Summary – TLDR:
- DarkSword and Coruna exploits are targeting outdated iOS devices through malicious websites.
- Hundreds of millions of iPhones may be vulnerable if not updated.
- Attackers can steal sensitive data including messages, passwords, and photos.
- Apple has released security updates and urges users to update immediately.
What Happened?
Apple and security researchers have identified multiple exploit chains, including DarkSword and Coruna, that target older iOS versions through compromised websites. These attacks can silently infect devices and steal sensitive data if users are running outdated software.
Apple is encouraging people to update their iPhones in light of new cybersecurity research that suggests that Russian intelligence, Chinese cybercriminals and other hackers have been using tools nicknamed DarkSword and Coruna to take over phones running older versions of the iOS… pic.twitter.com/ZDUC4UF0nE
— Yahoo News (@YahooNews) March 19, 2026
Exploit Kits Move From Targeted to Mass Attacks
For years, iPhone hacking tools were mostly used in highly targeted espionage campaigns. That is now changing. Security researchers from Google, iVerify, and Lookout have found that tools like DarkSword are being deployed on a much larger scale.
These exploits are now embedded in infected or compromised websites, turning everyday browsing into a potential risk. Simply visiting a malicious page can trigger an attack without any user interaction.
Researchers say this marks a major shift. What was once limited to state sponsored operations is now becoming widely available.
- Multiple threat actors are now using the same tools.
- Exploits are spreading across regions including Saudi Arabia, Turkey, Malaysia, and Ukraine.
- Tools are being reused and shared, making attacks easier to launch.
How DarkSword Works?
DarkSword operates by chaining together multiple vulnerabilities in iOS to gain deep access to a device. Once triggered, it can achieve kernel-level compromise, giving attackers extensive control.
The exploit works in stages:
- Delivered through compromised websites.
- Exploits multiple system flaws in sequence.
- Deploys payloads such as GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.
Unlike traditional spyware, DarkSword uses a fileless approach. It hijacks legitimate system processes instead of installing persistent malware. This makes it harder to detect and leaves fewer traces.
It also works quickly. Researchers describe it as a smash and grab attack, stealing data within minutes before disappearing after a reboot.
The data targeted includes:
- Passwords and photos.
- Messages from iMessage, WhatsApp, and Telegram.
- Browser history, notes, and calendar data.
- Even sensitive data from health and crypto wallets.
Why Older iPhones Are Most at Risk?
The attacks mainly affect devices running older iOS versions, including iOS 13 through iOS 18. Despite newer releases being available, a significant number of users have not updated their devices.
According to researchers, close to a quarter of iPhones are still running older versions like iOS 18, leaving hundreds of millions of users exposed.
Apple confirmed that devices running iOS 15 through iOS 26 with the latest updates are protected. However, users on outdated versions remain vulnerable.
Apple said:
Apple’s Response and What Users Should Do
Apple has released multiple security updates to address the vulnerabilities exploited by DarkSword and Coruna. These updates fix issues in key components like WebKit and the kernel.
The company recommends:
- Update to iOS 15.8.7 or iOS 16.7.15 for older devices.
- Upgrade to the latest iOS version if possible.
- Enable Lockdown Mode for added protection.
- Avoid clicking unknown links or visiting suspicious websites.
Apple also noted that Safari includes built in protections that block known malicious domains.
Security experts warn that these tools are becoming more accessible. Some exploit code has even been found openly available, making it easier for less sophisticated attackers to reuse.
Growing Market for iPhone Exploits
Researchers believe the rise of tools like DarkSword signals a growing underground market for mobile exploits. These tools are no longer limited to elite groups.
The availability of such exploits suggests:
- A commercial market where hacking tools are bought and sold.
- Increased risk of cybercriminal use beyond espionage.
- Faster spread and adaptation of attack techniques.
Experts warn that this trend could make large scale mobile attacks more common in the future.
SQ Magazine Takeaway
I think this is a serious turning point for iPhone security. What used to be rare and targeted attacks are now becoming widespread and almost routine. If someone is still using an outdated iPhone, they are basically leaving the door open for attackers. The biggest takeaway is simple but important, updating your device is no longer optional, it is essential.
