Researchers Link DarkSword iPhone Campaign Targeting Ukrainians to UNC6353
Summary
Lookout researchers attribute a watering-hole campaign targeting Ukrainians to UNC6353. DarkSword reportedly steals data from iPhones within minutes; Apple patched the exploited vulnerabilities in late 2025.
Key points
- Lookout researchers attribute the campaign to UNC6353, described as likely Russia-linked; the attribution is not presented as independently confirmed.
- The campaign has been active since at least late 2025 and targeted visitors to compromised Ukrainian websites, including a regional news outlet and a local court site.
- DarkSword reportedly triggers when a victim visits an infected page, requiring little or no user interaction.
- Researchers say the tool can collect emails, messages, photos, credentials and cryptocurrency wallet data, then delete itself.
- The campaign also targeted cryptocurrency platforms and wallets, including Coinbase, Binance, Kraken, MetaMask and Ledger.
- Apple patched the exploited vulnerabilities in late 2025 after they were disclosed.
Article Details
- Event Type
- iPhone malware campaign using watering-hole attacks against Ukrainian websites
- Impact
- DarkSword reportedly enabled rapid theft of emails, messages, photos, credentials, and cryptocurrency wallet data, then deleted itself. Researchers attributed the activity to UNC6353; Apple patched the exploited vulnerabilities in late 2025.
MITRE ATT&CK
Threat Actors
Malware
Vendors
Products
BinanceThe campaign operated on a hit-and-run model, rapidly exfiltrating data and then erasing traces, and targeted crypto platforms and wallets like Coinbase, Binance, Kraken, MetaMask and Ledger.CoinbaseThe campaign operated on a hit-and-run model, rapidly exfiltrating data and then erasing traces, and targeted crypto platforms and wallets like Coinbase, Binance, Kraken, MetaMask and Ledger.iPhoneA likely Russia-linked actor deployed a sophisticated iPhone hacking tool called DarkSword to target Ukrainian users via compromised websites, enabling rapid theft of sensitive data with little to no user interaction.KrakenThe campaign operated on a hit-and-run model, rapidly exfiltrating data and then erasing traces, and targeted crypto platforms and wallets like Coinbase, Binance, Kraken, MetaMask and Ledger.LedgerThe campaign operated on a hit-and-run model, rapidly exfiltrating data and then erasing traces, and targeted crypto platforms and wallets like Coinbase, Binance, Kraken, MetaMask and Ledger.MetaMaskThe campaign operated on a hit-and-run model, rapidly exfiltrating data and then erasing traces, and targeted crypto platforms and wallets like Coinbase, Binance, Kraken, MetaMask and Ledger.
Countries
MalaysiaAccording to a report by Google on Wednesday, DarkSword was deployed by various threat actors to target users in Saudi Arabia, Turkey and Malaysia.Saudi ArabiaAccording to a report by Google on Wednesday, DarkSword was deployed by various threat actors to target users in Saudi Arabia, Turkey and Malaysia.TurkeyAccording to a report by Google on Wednesday, DarkSword was deployed by various threat actors to target users in Saudi Arabia, Turkey and Malaysia.UkraineLittle is known about the group’s infrastructure or broader affiliations, but it has previously targeted victims in Ukraine using the Coruna exploit chain.
Industries
CryptocurrencyThe hit-and-run campaign attributed to UNC6353 exfiltrated emails, messages, photos, credentials and cryptocurrency wallet data before deleting itself, and Apple patched the exploited vulnerabilities in late 2025.Food processingCompromised targets included a regional news outlet, a local court site, and possibly a Ukrainian food processing company.