DarkSword iOS Exploit Kit Leaks on GitHub; Hundreds of Millions of iPhones Running iOS 18 at Risk

A newer version of the DarkSword iOS exploit kit was published on GitHub, potentially exposing hundreds of millions of iPhones running iOS 18 (versions 18.4 through 18.7) to spyware attacks. The kit chains six vulnerabilities, including three zero-days, for full device takeover through compromised websites with minimal user interaction. Google, iVerify, and Lookout confirmed DarkSword has been used by state-sponsored actors in campaigns centered on Ukraine, Saudi Arabia, Turkey, and Malaysia, with Russian group UNC6353 among identified users. Security researcher Allan Liska warned the leak 'democratizes' iPhone exploitation, previously reserved for nation-states. Apple patched all vulnerabilities in iOS 26.3; approximately 25% of iPhones still run vulnerable versions.