DarkSword iPhone Hacking Tool Puts Hundreds of Millions of iOS 18 Users at Risk
Summary
Researchers say the DarkSword toolkit is being delivered through infected websites and can silently steal data from most iOS 18 devices. Its code was left exposed; Apple says updates and Lockdown Mode protect users.
Key points
- Google, iVerify and Lookout reported that DarkSword was found on infected websites and can silently compromise devices running most versions of iOS 18; updated versions are not affected.
- Google says Russian state-sponsored hackers used DarkSword in an espionage campaign that embedded it in components of legitimate Ukrainian websites.
- Google also reported earlier use against victims in Saudi Arabia, Turkey and Malaysia; it said customers of Turkish firm PARS Defense appeared to use the tool against Turkish and Malaysian targets.
- Lookout says DarkSword can steal passwords, photos, messaging logs, browser history, personal data and cryptocurrency wallet credentials.
- iVerify describes DarkSword as fileless: it abuses legitimate system processes, steals data within minutes and does not persist after a device reboots.
- Researchers said the unobscured, documented code was left accessible on the infected sites, making it easier for other hackers to reuse.
- Apple says security updates protect against DarkSword and recommends keeping iOS updated; the company also says Lockdown Mode protects users.
Article Details
- Event Type
- Deployment of the DarkSword iPhone-hacking technique in campaigns using infected websites, including espionage and cybercriminal activity.
- Impact
- DarkSword can silently compromise many devices running most versions of iOS 18 when users visit infected websites. Lookout says it can steal passwords, photos, messaging logs, browser history, Calendar and Notes data, Health data, and cryptocurrency wallet credentials. The infection does not persist after a reboot. Apple says security updates protect users, and Lockdown Mode also provides protection.
MITRE ATT&CK
People
Justin AlbrechtLeads mobile threat intelligence at Lookout and discussed the market for resale of iOS exploits.Matthias FrielingsdorfiVerify cofounder and researcher who described finding unobscured DarkSword code on compromised websites and the risk of others reusing it.Rocky ColeiVerify cofounder and CEO who discussed DarkSword's techniques, impact, and the risks of its reuse.
Threat Actors
Operation ZeroA Russian broker firm that received tools sold by Peter Williams. The article says DarkSword may have been sold by Operation Zero or another broker; it does not establish that Operation Zero created or sold DarkSword.Peter WilliamsFormer Trenchant employee who pleaded guilty to selling the company's tools to Operation Zero, according to the article.
Vendors
Products
iOSAnd one new technique in particular—capable of taking over any of hundreds of millions of iOS devices—has appeared on the web in an easily reusable form, putting a significant fraction of the world’s iPhone users atiPhoneiPhone hacking techniques have sometimes been described almost like rare and elusive animals: Hackers have used them so stealthily and carefully against such a small number of hand-picked targets that they’re only
Tools
Corunaafter the revelation of another, even more sophisticated and fully featured hacking toolkit known as Coruna was found in use by what Google describes as a Russian state-sponsored espionage group and other hackerDarkSwordon Wednesday jointly revealed the discovery of a sophisticated iPhone hacking technique known as DarkSword that they’ve seen in use on infected websites, capable of instantly and silently hacking iOS devices
Countries
MalaysiaBeyond this Russian spy campaign, according to Google, DarkSword was spotted earlier when hackers used it to compromise the phones of victims in Saudi Arabia, Turkey, and Malaysia.Saudi ArabiaBeyond this Russian spy campaign, according to Google, DarkSword was spotted earlier when hackers used it to compromise the phones of victims in Saudi Arabia, Turkey, and Malaysia.TurkeyBeyond this Russian spy campaign, according to Google, DarkSword was spotted earlier when hackers used it to compromise the phones of victims in Saudi Arabia, Turkey, and Malaysia.