Darksword exploit kit stalks 270 million iphones weeks after coruna
A second iPhone exploit kit is loose in the wild, and this one has already phished Saudi diplomats, Turkish executives and Malaysian crypto traders. Researchers at Google, Lookout and iVerify call it Darksword. Apple calls it solved—provided you updated in 2026.
The malware’s payload is surgical: swipe Face ID passcodes, empty Trust Wallet seeds, hijack 2FA codes and vanish. Victims notice only when the wallet is drained and the bank app greets them in Russian.
How 18.4 became the new digital twilight zone
Darksword rides a trio of WebKit zero-days patched quietly between iOS 18.4 and 18.6.2. Apple pushed the fixes last spring, but carrier inertia and “update tonight” fatigue left an estimated 270 million devices frozen on the wrong side of the code fork. That number equals the entire population of Brazil holding a ticking zero-click bomb in its pocket.
The infection chain is insultingly simple: a missed call on WhatsApp, a link preview that never asked to be tapped, a Safari tab that opens, closes and forgets it ever existed. Thirty seconds later the kernel grants the attacker read-write-execute privileges usually reserved for first-party daemons.
From fort meade to riyadh in one url
Rocky Cole, COO of iVerify, traces the command-and-control IPs to bulletproof hosts in Moldova and Kazakhstan—addresses that once hosted NSO Group samples in 2021. “The commercial barrier to entry is collapsing,” Cole told TechBloom. “What used to cost governments seven figures now ships as a $3 000 SaaS subscription.”
Apple’s response arrived within hours: the domains are already black-holed by Safe Browsing, the WebKit bugs are extinct on any phone running iOS 26 or later, and the company’s private threat-intel feed has pushed new indicators to every iPhone that still dials home. Translation: if you are not on 26, you are not on the list.
The calendar says 2027, but for one in four iPhone owners the clock stopped two winters ago. They scroll, they shop, they scan QR codes in Starbucks, unaware that a silent browser tab is auctioning their biometric hash to the highest bidder. The patch is free. The update weighs 2.3 GB. The ransom for skipping it starts at your entire digital life.