NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

DarkSword spyware used malicious and compromised websites to take over iPhones

DarkSword used website visits to compromise outdated iPhones and steal private data. Attacks were observed in four countries. Install the latest available update; protections include iOS 26.3 and iOS 18.7.7.

What to do

On your iPhone or iPad, open Settings > General > Software Update and install the latest available update; DarkSword protections include iOS/iPadOS 26.3 and the 18.7.7 update for devices remaining on version 18. Enable Automatic Updates. If you cannot update immediately, enable Lockdown Mode under Settings > Privacy & Security.

Check your devices
  • iOS (18.x)fixed in 18.7.7 and later
  • iOS (26.x)fixed in 26.3 and later
  • iPadOS (18.x)fixed in 18.7.7 and later
  • iPadOS (26.x)fixed in 26.3 and later

What’s happening

DarkSword is an iPhone attack toolkit delivered through malicious websites and legitimate sites that attackers compromised. Google observed campaigns against people in Saudi Arabia, Turkey, Malaysia and Ukraine from at least November 2025, with support for iOS 18.4–18.7. iVerify examined a Ukrainian campaign targeting iOS 18.4–18.6.2. Payloads could collect messages, account information, location history and cryptocurrency wallet data. The toolkit combined six vulnerabilities; Google said all six had been fixed by iOS 26.3. Apple subsequently expanded iOS 18.7.7 availability on 1 April to deliver DarkSword protections to more devices remaining on iOS 18. Fixes are available, but the reviewed sources do not establish that every campaign has stopped or give a confirmed victim total. Updating does not retrieve data already stolen.

What
Flaw
Affects
Apple iPhone and iPad (iOS and iPadOS)
Affected
Observed DarkSword toolkit: iPhones running iOS 18.4–18.7, according to Google; iVerify's examined campaign targeted iOS 18.4–18.6.2.
Apple's iOS 18.7.7 DarkSword protection coverage: iPhone XR, iPhone XS, iPhone XS Max, iPhone 11–16 models, iPhone 16e, and iPhone SE (2nd and 3rd generation).
Apple's iPadOS 18.7.7 coverage includes iPad mini (5th generation–A17 Pro), iPad (7th generation–A16), iPad Air (3rd–5th generation), iPad Air 11-inch and 13-inch (M2–M3), iPad Pro 11-inch (1st generation–M4), iPad Pro 12.9-inch (3rd–6th generation), and iPad Pro 13-inch (M4).
Fixed in
iOS 26.3 and iPadOS 26.3: all six component vulnerabilities fixed.
iOS 18.7.7 and iPadOS 18.7.7: Apple identifies DarkSword protections; iOS availability expanded on 1 April 2026.
CVE
CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520
Since
18 Mar 2026
Closed
1 Apr 2026

Timeline

  1. Vendor revisedFixed

    Apple expanded iOS 18.7.7 availability to more devices so people with Automatic Updates enabled could receive DarkSword protections while remaining on iOS 18.

  2. New fixPartly fixed

    Apple released iOS and iPadOS 18.7.7. Its subsequently revised advisory identifies this release as providing protections against DarkSword.

  3. CISA added

    CISA added CVE-2025-31277, CVE-2025-43510 and CVE-2025-43520 to its catalogue of vulnerabilities used in attacks.

  4. Made public

    Google disclosed DarkSword, observed since at least November 2025 against people in Saudi Arabia, Turkey, Malaysia and Ukraine. It identified six vulnerabilities and said all six had fixes by iOS 26.3.

  5. New fixPartly fixed

    Apple released iOS and iPadOS 26.3, fixing CVE-2026-20700 in dyld. Apple linked its reported exploitation to the attacks involving CVE-2025-43529 and CVE-2025-14174.

  6. New fixPartly fixed

    Apple released iOS and iPadOS 26.2, fixing CVE-2025-43529 and CVE-2025-14174 in WebKit. Apple acknowledged reports of targeted exploitation on versions before iOS 26.

  7. New fixPartly fixed

    Apple released iOS and iPadOS 18.7.2 with fixes for kernel flaws CVE-2025-43510 and CVE-2025-43520. Apple added their CVE entries to the advisory on 12 December.

  8. New fixPartly fixed

    Apple released iOS 18.6, fixing CVE-2025-31277, one of the browser flaws later used by DarkSword.

Sources

  1. About the security content of iOS 18.7.7 and iPadOS 18.7.7Apple · 24 Mar 2026
  2. About the security content of iOS 26.3 and iPadOS 26.3Apple · 11 Feb 2026
  3. About the security content of iOS 26.2 and iPadOS 26.2Apple · 12 Dec 2025
  4. About the security content of iOS 18.7.2 and iPadOS 18.7.2Apple · 5 Nov 2025
  5. About the security content of macOS Sequoia 15.6Apple · 29 July 2025
  6. The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsGoogle Threat Intelligence Group · 18 Mar 2026
  7. Inside DarkSword: A New iOS Exploit Kit Delivered Via Compromised Legitimate WebsitesiVerify · 18 Mar 2026
  8. CISA Known Exploited Vulnerabilities catalogueCISA · 30 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS