{"id":"darksword-iphone-website-spyware-mar-2026","category":"patch","status":"closed","title":"DarkSword spyware used malicious and compromised websites to take over iPhones","tldr":"DarkSword used website visits to compromise outdated iPhones and steal private data. Attacks were observed in four countries. Install the latest available update; protections include iOS 26.3 and iOS 18.7.7.","summary":"DarkSword is an iPhone attack toolkit delivered through malicious websites and legitimate sites that attackers compromised. Google observed campaigns against people in Saudi Arabia, Turkey, Malaysia and Ukraine from at least November 2025, with support for iOS 18.4–18.7. iVerify examined a Ukrainian campaign targeting iOS 18.4–18.6.2. Payloads could collect messages, account information, location history and cryptocurrency wallet data. The toolkit combined six vulnerabilities; Google said all six had been fixed by iOS 26.3. Apple subsequently expanded iOS 18.7.7 availability on 1 April to deliver DarkSword protections to more devices remaining on iOS 18. Fixes are available, but the reviewed sources do not establish that every campaign has stopped or give a confirmed victim total. Updating does not retrieve data already stolen.","action":"On your iPhone or iPad, open Settings > General > Software Update and install the latest available update; DarkSword protections include iOS/iPadOS 26.3 and the 18.7.7 update for devices remaining on version 18. Enable Automatic Updates. If you cannot update immediately, enable Lockdown Mode under Settings > Privacy & Security.","product":"Apple iPhone and iPad (iOS and iPadOS)","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-31277","CVE-2025-43529","CVE-2026-20700","CVE-2025-14174","CVE-2025-43510","CVE-2025-43520"],"tags":["apple","iphone","ios","spyware","webkit","zero-day"],"affected":["Observed DarkSword toolkit: iPhones running iOS 18.4–18.7, according to Google; iVerify's examined campaign targeted iOS 18.4–18.6.2.","Apple's iOS 18.7.7 DarkSword protection coverage: iPhone XR, iPhone XS, iPhone XS Max, iPhone 11–16 models, iPhone 16e, and iPhone SE (2nd and 3rd generation).","Apple's iPadOS 18.7.7 coverage includes iPad mini (5th generation–A17 Pro), iPad (7th generation–A16), iPad Air (3rd–5th generation), iPad Air 11-inch and 13-inch (M2–M3), iPad Pro 11-inch (1st generation–M4), iPad Pro 12.9-inch (3rd–6th generation), and iPad Pro 13-inch (M4)."],"fixed":["iOS 26.3 and iPadOS 26.3: all six component vulnerabilities fixed.","iOS 18.7.7 and iPadOS 18.7.7: Apple identifies DarkSword protections; iOS availability expanded on 1 April 2026."],"matches":[{"platform":"ios","app":"iOS (18.x)","bundle":"","fixed":"18.7.7"},{"platform":"ios","app":"iOS (26.x)","bundle":"","fixed":"26.3"},{"platform":"ipados","app":"iPadOS (18.x)","bundle":"","fixed":"18.7.7"},{"platform":"ipados","app":"iPadOS (26.x)","bundle":"","fixed":"26.3"}],"sources":[{"kind":"advisory","title":"About the security content of iOS 18.7.7 and iPadOS 18.7.7","url":"https://support.apple.com/en-ae/126793","by":"Apple","date":"2026-03-24"},{"kind":"advisory","title":"About the security content of iOS 26.3 and iPadOS 26.3","url":"https://support.apple.com/en-us/126346","by":"Apple","date":"2026-02-11"},{"kind":"advisory","title":"About the security content of iOS 26.2 and iPadOS 26.2","url":"https://support.apple.com/en-us/125884","by":"Apple","date":"2025-12-12"},{"kind":"advisory","title":"About the security content of iOS 18.7.2 and iPadOS 18.7.2","url":"https://support.apple.com/en-us/125633","by":"Apple","date":"2025-11-05"},{"kind":"advisory","title":"About the security content of macOS Sequoia 15.6","url":"https://support.apple.com/en-us/124149","by":"Apple","date":"2025-07-29"},{"kind":"research","title":"The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors","url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","by":"Google Threat Intelligence Group","date":"2026-03-18"},{"kind":"research","title":"Inside DarkSword: A New iOS Exploit Kit Delivered Via Compromised Legitimate Websites","url":"https://www.iverify.com/blog/darksword-ios-exploit-kit-explained","by":"iVerify","date":"2026-03-18"},{"kind":"advisory","title":"CISA Known Exploited Vulnerabilities catalogue","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-10-30"}],"started":"2026-03-18","closed":"2026-04-01","created":"2026-11-03T20:17:16.488Z","updated":"2026-11-03T20:17:16.488Z","cve_notes":[{"cve":"CVE-2025-31277","name":"Memory corruption in Apple's WebKit","what":"A memory-handling flaw in WebKit allows malicious web content to corrupt memory in the process handling it.","severity":"unknown","cvss":0},{"cve":"CVE-2025-43529","name":"Use-after-free in Apple's WebKit","what":"A use-after-free flaw in WebKit allows malicious web content to run attacker-controlled code.","severity":"unknown","cvss":0},{"cve":"CVE-2026-20700","name":"Memory corruption in Apple's dyld loader","what":"A memory-corruption flaw in dyld, Apple's program loader, lets an attacker who already has the ability to write memory run attacker-controlled code.","severity":"unknown","cvss":0},{"cve":"CVE-2025-14174","name":"Memory corruption in WebKit's ANGLE graphics component","what":"A memory-corruption flaw affecting WebKit's ANGLE graphics component allows malicious web content to corrupt memory.","severity":"unknown","cvss":0},{"cve":"CVE-2025-43510","name":"Lock-state flaw in Apple's kernel","what":"A memory-corruption flaw in the kernel's lock-state handling lets a malicious app unexpectedly change memory shared between processes.","severity":"unknown","cvss":0},{"cve":"CVE-2025-43520","name":"Memory corruption in Apple's kernel","what":"A memory-corruption flaw in the kernel lets a malicious app crash the system or write to kernel memory.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-04-01","added":"2026-11-03T20:12:05.486Z","kind":"vendor-revised","text":"Apple expanded iOS 18.7.7 availability to more devices so people with Automatic Updates enabled could receive DarkSword protections while remaining on iOS 18.","url":"https://support.apple.com/en-ae/126793","by":"Apple","patch":"patched"},{"at":"2026-03-24","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS and iPadOS 18.7.7. Its subsequently revised advisory identifies this release as providing protections against DarkSword.","url":"https://support.apple.com/en-ae/126793","by":"Apple","patch":"partial"},{"at":"2026-03-20","added":"2026-11-03T20:12:05.486Z","kind":"cisa-added","text":"CISA added CVE-2025-31277, CVE-2025-43510 and CVE-2025-43520 to its catalogue of vulnerabilities used in attacks.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-03-18","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Google disclosed DarkSword, observed since at least November 2025 against people in Saudi Arabia, Turkey, Malaysia and Ukraine. It identified six vulnerabilities and said all six had fixes by iOS 26.3.","url":"https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain","by":"Google Threat Intelligence Group","patch":null},{"at":"2026-02-11","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS and iPadOS 26.3, fixing CVE-2026-20700 in dyld. Apple linked its reported exploitation to the attacks involving CVE-2025-43529 and CVE-2025-14174.","url":"https://support.apple.com/en-us/126346","by":"Apple","patch":"partial"},{"at":"2025-12-12","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS and iPadOS 26.2, fixing CVE-2025-43529 and CVE-2025-14174 in WebKit. Apple acknowledged reports of targeted exploitation on versions before iOS 26.","url":"https://support.apple.com/en-us/125884","by":"Apple","patch":"partial"},{"at":"2025-11-05","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS and iPadOS 18.7.2 with fixes for kernel flaws CVE-2025-43510 and CVE-2025-43520. Apple added their CVE entries to the advisory on 12 December.","url":"https://support.apple.com/en-us/125633","by":"Apple","patch":"partial"},{"at":"2025-07-29","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Apple released iOS 18.6, fixing CVE-2025-31277, one of the browser flaws later used by DarkSword.","url":"https://www.iverify.com/blog/darksword-ios-exploit-kit-explained","by":"iVerify","patch":"partial"}],"url":"https://hard.fyi/live/darksword-iphone-website-spyware-mar-2026/","json":"https://hard.fyi/api/live?id=darksword-iphone-website-spyware-mar-2026"}