Leaked iPhone exploit kit puts millions of older devices at risk

An exploit kit known as DarkSword has been publicly leaked on the code-sharing site GitHub, enabling attackers to target iPhone users running older software versions. The leak of the spyware, which has been characterized as malware used in a hacking campaign, allows attackers to easily execute active attacks against vulnerable devices. Security researchers warn that the public availability of these files makes it simple for anyone to deploy the exploit.

The leak likely affects hundreds of millions of actively used iPhones and iPads. According to Apple, about one-quarter of its 2.5 billion active devices are still running iOS 18 or earlier, leaving them vulnerable to the exploit. Matthias Frielingsdorf, the co-founder of mobile security startup iVerify, spoke to TechCrunch on Monday regarding the severity of the leak, warning that the tools are too easy to repurpose and cannot be contained. “The exploits will work out of the box,” Frielingsdorf said, noting that no specialized expertise is required to deploy the files. Google, which also analyzed the exploit, agreed with this assessment.

Apple spokesperson Sarah O’Rourke urged users to update their devices, stating that keeping software up to date is the single most important action to maintain product security. O’Rourke noted that updated devices are not at risk and that Lockdown Mode—Apple’s extreme security setting for high-risk users—would also block these specific attacks. Apple issued an emergency update on March 11 for devices unable to run recent versions of iOS.

The DarkSword spyware was allegedly used by Russian government hackers against Ukrainian targets. The discovery of the toolkit follows the recent exposure of another hacking toolkit called Coruna. Coruna was developed by L3Harris, a defense contractor that makes hacking tools for the U.S. government and its allies.

Why it matters

The public availability of sophisticated exploit tools lowers the barrier for entry for attackers, turning previously targeted, high-end spyware into a widespread threat for users who have not updated their devices.