Security researchers disclosed yesterday that DarkSword, a sophisticated iOS exploit kit, has compromised up to 270 million iPhones through drive-by attacks on legitimate websites—including Ukrainian government sites. Google Threat Intelligence, Malwarebytes, Lookout, and iVerify announced on March 19 that the exploit chains six vulnerabilities (three zero-days) to achieve full device takeover with zero user interaction. Russian espionage group UNC6353 and commercial surveillance vendors have deployed DarkSword since November 2025.
This breaks the traditional mobile security model. You can’t avoid infection by being cautious—simply visiting a compromised website with a vulnerable iPhone (iOS 18.4 through 18.7) triggers the full exploit chain in under 60 seconds. Apple markets iOS as the most secure mobile operating system, but DarkSword proves that “most secure” is relative when state actors invest millions in exploit development.
DarkSword iOS Exploit: 270M Devices Vulnerable
Lookout and iVerify estimate 220 to 270 million iPhones globally remain vulnerable to DarkSword. Moreover, the exploit uses “watering hole” attacks where legitimate websites are compromised with malicious iframes. Ukrainian government websites served DarkSword from December 2025 through March 2026—officials and citizens visiting these sites from vulnerable iPhones were infected automatically.
This is mass surveillance infrastructure disguised as legitimate web traffic. Furthermore, users face zero indication of attack: no app download, no suspicious link click, just normal browsing of trusted government sites. Users cannot protect themselves through cautious behavior alone because the attack surface is the entire web—any compromised site becomes an infection vector.
The scale here isn’t targeted espionage—it’s opportunistic mass surveillance. When you compromise a government website visited by thousands daily, you’re not hunting specific high-value targets. Instead, you’re harvesting whoever shows up with a vulnerable device.
Six-Vulnerability Chain Defeats iOS Security
DarkSword chains six vulnerabilities in sequence to progressively escape iOS security sandboxes: Safari WebKit exploit (CVE-2025-31277 or CVE-2025-43529) → Pointer Authentication Codes bypass (CVE-2026-20700) → sandbox escape to GPU process (CVE-2025-14174) → second sandbox escape to mediaplaybackd system service (CVE-2025-43510) → kernel privilege escalation (CVE-2025-43520). All stages execute as fileless JavaScript, leaving no traditional malware signatures.
Each vulnerability defeats a different iOS security mechanism. The WebKit exploit gets initial code execution in the browser sandbox. The PAC bypass defeats hardware-level code signing. Additionally, the ANGLE vulnerability pivots to the GPU process. The XNU kernel bug pivots to mediaplaybackd with higher privileges. Finally, the VFS race condition provides kernel read/write access. It’s systematic dismantling of Apple’s layered defense model.
What makes this particularly dangerous: fileless operation. Traditional antivirus apps can’t detect JavaScript-based payloads because there are no binaries to scan. The exploit chain executes, steals data, cleans up traces, and vanishes—all in memory, nothing written to disk. Consequently, from a forensics perspective, you’d struggle to prove infection even if you suspected compromise.
Russian Espionage Meets Commercial Spyware Market
UNC6353, described by Lookout as a “well-funded and connected threat actor conducting attacks for financial gain and espionage in alignment with Russian intelligence requirements,” deployed DarkSword against Ukrainian targets starting December 2025. However, UNC6353 isn’t the only buyer. Turkish commercial surveillance vendor PARS Defense used the same exploit kit in Turkey. Multiple threat actors across Saudi Arabia, Turkey, Malaysia, and Ukraine have adopted DarkSword.
The code tells the story of proliferation. Early infrastructure stages contain Russian language comments. Subsequent exploit stages switch to English. That’s the pattern of a commercial toolkit built by one developer or team, then sold or transferred to multiple buyers globally. Moreover, the Biden administration’s Entity List restrictions on NSO Group and Intellexa haven’t stopped the commercial spyware market—new vendors emerge, often staffed by the same Israeli intelligence alumni under different corporate structures.
This isn’t one state actor with one exploit. It’s commercial infrastructure. When the same exploit kit shows up in Russian espionage campaigns, Turkish surveillance operations, and across the Middle East, you’re looking at a thriving market for iOS exploits despite U.S. sanctions.
Comprehensive Surveillance With Financial Motive
The Ghostblade payload steals comprehensive data in a single sweep: SMS, iMessage, WhatsApp, Telegram, call history, contacts, photos, location history, Wi-Fi passwords, Safari cookies, keychain credentials, health data, and iCloud files. However, here’s what sets it apart from pure espionage tools: Ghostblade specifically enumerates cryptocurrency wallets (Ledger, Trezor, Metamask, Exodus, Uniswap, Phantom, Gnosis Safe) and exchange apps (Coinbase, Binance, Kraken, Kucoin, OKX, Mexc).
This isn’t espionage or financial crime—it’s both. The crypto targeting shows threat actors are monetizing surveillance infrastructure directly. If you’re a developer, tech professional, or early adopter holding digital assets, you’re not just a privacy violation target. You’re a direct financial target. Consequently, the same Russian espionage operation stealing Ukrainian intelligence data is also harvesting crypto wallet credentials for financial gain.
Data exfiltration completes in minutes, then the exploit cleans up traces automatically. The victim has no indication of compromise—no notification, no performance degradation, no battery drain. Just silent, comprehensive data theft.
Updates Available, But Millions Remain Vulnerable
Apple patched all six DarkSword vulnerabilities in iOS 18.7.3, iOS 26.2, and iOS 26.3. The company even pushed emergency updates for legacy iOS 15 and iOS 16 devices—rare backporting that demonstrates how seriously Apple took this threat. Lockdown Mode, Apple’s high-risk user protection feature, completely blocks DarkSword by disabling JIT JavaScript compilation.
The patches shipped months ago. Yet 220 to 270 million iPhones remain vulnerable because users haven’t updated. That’s not a technical failure—it’s a systemic security hygiene crisis. Patch availability doesn’t equal patch deployment when hundreds of millions of users ignore update notifications or disable automatic updates.
Google’s advisory is blunt: update to the latest iOS version or enable Lockdown Mode “for enhanced security” if updating isn’t possible. For high-risk users—journalists covering sensitive topics, activists in conflict zones, government officials, corporate executives with trade secrets, anyone holding significant crypto assets—Lockdown Mode isn’t optional anymore. It disables some features (message attachments, link previews, JIT JavaScript), but state-level surveillance capability justifies the trade-off.
The technical defense exists. Apple’s response was strong—emergency patches, backported updates, confirmed Lockdown Mode effectiveness. But the human factor undermines it. When 270 million devices remain vulnerable to a publicly disclosed exploit with available patches, we have a security hygiene problem that no amount of engineering can solve.
Key Takeaways
Update immediately: Check Settings → General → Software Update and install iOS 18.7.3 or later (or iOS 26.2+). This is a zero-click exploit—you can’t avoid it through caution.
Enable Lockdown Mode if you’re high-risk: Journalists, activists, executives, government officials, and anyone holding significant crypto assets should enable Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). The feature disables attack vectors DarkSword relies on.
Understand the threat model: This isn’t targeted surveillance—it’s mass surveillance infrastructure. Any compromised website becomes an infection vector. Therefore, 270 million vulnerable devices means you’re statistically at risk even if you’re not a “high-value target.”
Commercial spyware is proliferating: U.S. sanctions on NSO Group haven’t stopped the market. New vendors emerge, the same exploit kits sell to multiple buyers globally, and state-level capability is increasingly accessible to commercial actors. Expect more DarkSwords.
