New iPhone spyware affects millions of devices: Here's what you need to know

iphones

• Darksword spyware hits millions of iPhones through hacked sites
• Devices running iOS 18.4 to 18.6.2 are most at risk
• Apple urges users to update iOS and enable Safe Browsing features

Did our AI summary help?

A newly discovered spyware campaign targeting Apple iPhones has raised concerns among cybersecurity researchers, with millions of devices potentially at risk. The malware, dubbed “Darksword,” has been identified as a powerful exploit capable of stealing sensitive data, including personal information and cryptocurrency wallet details.

How the newly discovered spyware works

According to findings from cybersecurity firms Lookout, iVerify, and Google, the Darksword spyware was distributed through dozens of compromised websites, particularly in Ukraine. Users running older versions of iOS—specifically between iOS 18.4 and iOS 18.6.2—were vulnerable if they visited these malicious sites.

Once triggered, the exploit could infiltrate the device and extract sensitive data without requiring extensive user interaction. Researchers said such tools were previously limited to highly targeted operations but are now being used in broader campaigns, indicating a shift in how these exploits are deployed.

The same infrastructure was also linked to another spyware campaign called “Coruna,” highlighting a growing ecosystem of iPhone-targeting malware.

Who is affected

Researchers estimate that between 220 million and 270 million iPhones globally may still be running the affected versions of iOS. This puts a significant number of users at risk, especially those who have not updated their devices regularly.

The spyware has reportedly been used in campaigns targeting users across multiple countries, including Saudi Arabia, Turkey, Malaysia, and Ukraine. Some of these campaigns are believed to be linked to commercial surveillance vendors and possibly state-backed actors.

Apple has stated that the vulnerabilities exploited by Darksword have already been patched in newer software updates. The company also noted that its Safari browser blocks known malicious domains associated with the attack.

What users should do

Security experts emphasise that keeping devices updated is the most effective way to stay protected. Users are advised to install the latest iOS updates immediately to close any known vulnerabilities.

Additionally, avoiding suspicious websites and ensuring that Safe Browsing features are enabled can reduce the risk of exposure. While Apple has addressed the issue in recent updates, the scale of the threat highlights the importance of regular software maintenance.