Someone has publicly leaked an exploit kit that can hack millions of iPhones

Last week, cybersecurity researchers uncovered a hacking campaign targeting iPhone users that used an advanced hacking tool called DarkSword. Now, someone has leaked a newer version of DarkSword and published it on the code sharing site GitHub.

Researchers are warning that this will allow any hacker to easily use the tools to target iPhone users running older versions of Apple’s operating systems who have not yet updated to its latest iOS 26 software. This likely affects hundreds of millions of actively used iPhones and iPads, according to Apple’s own data on out-of-date devices.

“This is bad. They are way too easy to repurpose,” Matthias Frielingsdorf, the co-founder of mobile security startup iVerify, told TechCrunch on Monday. “I don’t think that can be contained anymore. So we need to expect criminals and others to start deploying this.”

Frielingsdorf said that these new versions of DarkSword spyware share the same infrastructure with the ones he and his iVerify colleagues analyzed previously, although the files are slightly different. The files uploaded to GitHub are uncomplicated, just HTML and JavaScript, he said, meaning anyone can copy and paste them and host them on a server “in a couple minutes to hours.”

“The exploits will work out of the box,” Frielingsdorf said. “There is no iOS expertise required.”

Kimberly Samra, a spokesperson for Google, which previously analyzed the DarkSword exploit, said the company’s researchers agree with Frielingsdorf’s assessment. 

A security hobbyist who goes by the handle matteyeux also told TechCrunch that it is indeed trivial to use the leaked DarkSword samples. Matteyeux wrote in a post on X Monday that he was able to hack an iPad mini tablet running iOS 18, the previous generation of the operating system that is vulnerable to DarkSword, using the “in the wild” DarkSword sample that is circulating online. 

Apple spokesperson Sarah O’Rourke told TechCrunch that the company was aware of the exploit targeting devices running older and out-of-date operating systems, and issued an emergency update on March 11 for devices unable to run recent versions of iOS. 

“Keeping your software up to date is the single most important thing you can do to maintain the security of your Apple products,” O’Rourke said, adding that devices with updated software were not at risk from these reported attacks, and that Lockdown Mode would also block these specific attacks.

A spokesperson for Microsoft, which owns GitHub, did not immediately respond to a request for comment.

The code, which TechCrunch is not linking to as it can be used in active attacks, contains several comments that describe how the exploits work and how to implement them. 

One comment, likely written by one of the developers who worked on DarkSword, says that the exploit “reads and exfiltrates forensically-relevant files from iOS devices via HTTP,” referring to stealing information from a person’s iPhone or iPad and sending the data over the internet to an attacker-controlled server. 

“This payload should be injected into a process with filesystem access class,” the comment reads.

In one case, the code references “post-exploitation activity,” and describes process after the malware has gained access to the person’s phone and grabs its contents, including their contacts, messages, call history, and iOS keychain, which stores Wi-Fi passwords and other secrets, and dumps them into a remote server.

Another file contains references to uploading data to a popular Ukrainian apparel website, though TechCrunch could not immediately determine why. DarkSword was allegedly used by Russian government hackers against Ukrainian targets. 

This particular spyware works specifically against iPhones and iPads running iOS 18, according to iVerify, Google, and Lookout, which also previously analyzed the DarkSword malware.

According to Apple’s own numbers, about one-quarter of all iPhone and iPad users are still running iOS 18 or earlier on their device. With more than 2.5 billion active devices, that likely equates to hundreds of millions of people whose devices are vulnerable to DarkSword attacks.  

That’s why Frielingsdorf recommends everyone to upgrade their iPhone’s operating system. 

The discovery of DarkSword came only a few weeks after researchers discovered another advanced iPhone hacking toolkit known as Coruna. As TechCrunch reported, Coruna was originally developed by the defense contractor L3Harris, whose Trenchant division makes hacking tools for the U.S. government and its allies.