DarkSword Malware Targets iPhones via Compromised Websites

• •DarkSword exploits six vulnerabilities in iOS, three of which are zero-days.
• •The malware targets unpatched iPhones through compromised legitimate websites.
• •Google has patched the vulnerabilities, but many users remain vulnerable due to outdated software.

Google's Threat Intelligence Group reported on the DarkSword malware, an exploit kit targeting iPhones running iOS versions 18.4 to 18.7. The malware exploits six vulnerabilities, three of which are zero-days, to take control of devices when users visit compromised websites. The attackers have been linked to three distinct campaigns, including a suspected Russian espionage group targeting Ukrainian sites. While Google has patched all vulnerabilities in iOS 26.3, many users remain at risk if they have not updated their devices. The malware can be deployed easily by less skilled attackers, making it a significant threat. The report highlights that legitimate sites, including a Ukrainian government domain, were used to deliver the malware, increasing the scope of potential victims. Current versions of iOS that have been patched include 26.4 and earlier updates for iOS 15 and 16.