DarkSword iOS Attack Tool Used in Real-World Cyberattacks

The iOS attack tool DarkSword has been used in actual cyberattacks, according to newly revealed evidence. The tool targets cryptocurrency wallet and account information. Google Threat Intelligence Group stated that DarkSword was deployed in attacks targeting users from Saudi Arabia, Turkey, Malaysia, and Ukraine starting November 2025.

DarkSword exploits six vulnerabilities in iOS 18.4–18.7 to take control of devices and execute malicious code. Lookout and IberyPay also analyzed that DarkSword can collect text messages, browser history, credentials, and cryptocurrency wallet information. Google recommends updating to the latest iOS version or enabling lock mode if updates are difficult.