A new iPhone spyware, Darksword, targeted 220–270 million devices via compromised Ukrainian sites, likely by financially motivated hackers.

A new iPhone spyware called Darksword has been discovered targeting 220 million to 270 million devices running iOS 18.4 to 18.6.2, exploiting vulnerabilities via compromised Ukrainian websites. Found by Lookout, iVerify, and Google, it was linked to the separate spyware Coruna and likely used by financially motivated actors rather than state groups, due to weak operational security. Although Apple has patched the flaws in newer updates, many users remain at risk. Malicious domains are now blocked by Safari’s Safe Browsing.