DarkSword: The iPhone Threat Every Business Owner Needs to Know About
- Erick Grau
- Mar 19
- 3 min read
If you or anyone on your team uses an iPhone for work, this one's for you. Security researchers just uncovered a new piece of malware called DarkSword — and it's one of the most dangerous mobile threats we've seen. It can steal your passwords, emails, messages, photos, and even cryptocurrency wallets from your iPhone in minutes. The worst part? You don't have to click anything for it to work.
This isn't a hypothetical risk or a scare tactic. DarkSword is actively being used in the wild right now, and it targets iPhones running iOS 18.4 through 18.6.2 — versions that millions of devices are still running today.
What Is DarkSword and Why Should You Care?
DarkSword is what security experts call a "full exploit chain" — but let's skip the jargon. Think of it like a master key that can unlock your iPhone, walk through every room, grab everything valuable, and leave before you even know someone was there. It gets in through your web browser — just visiting a compromised website is enough. No suspicious links to click, no shady apps to download.
Once inside, DarkSword collects an alarming amount of data in seconds:
Saved passwords and login credentials
Emails, text messages, and WhatsApp/Telegram history
Cryptocurrency wallets (Coinbase, Binance, MetaMask, Ledger, and more)
Photos, contacts, call history, and location data
WiFi passwords and browser history
Then it cleans up after itself and disappears. The whole attack takes minutes. That's like a burglar breaking into your office, photocopying every file in every cabinet, and leaving without a trace.
Why This Is Different from Other Threats
Most mobile threats require you to do something wrong — click a phishing link, install a fake app, or open a malicious attachment. DarkSword doesn't need any of that. It uses what's called a "watering hole" attack — the attackers compromise a legitimate website that their targets already visit, then wait for them to show up. It's almost impossible to defend against with awareness training alone because the website itself looks completely normal.
What makes this even more concerning is that these kinds of sophisticated exploits used to be available only to governments and intelligence agencies. DarkSword proves there's now a black market where well-funded criminal groups can buy these tools off the shelf. The attackers behind DarkSword — a likely Russian group tracked as UNC6353 — appear to be motivated by both espionage and financial theft, particularly targeting cryptocurrency.
What You Should Do Right Now
The good news? You can protect yourself and your team with a few straightforward steps:
Update every iPhone immediately. Devices running iOS 18.7.3 or later (or iOS 26.3+) are not affected. Make this a company-wide priority today.
Replace devices that can't update. If anyone on your team has an older iPhone that can't run the latest iOS, it's time to upgrade. An outdated phone is an open door.
Enable automatic updates across your fleet. Don't rely on employees remembering to update — make it automatic through your mobile device management.
Talk to your IT provider about mobile threat protection. If your IT team isn't actively monitoring mobile devices, you've got a blind spot in your security.
Key Points of the DarkSword Threat
DarkSword is a sophisticated iPhone malware that can steal passwords, emails, crypto wallets, and more — without you clicking anything.
It targets iPhones running iOS 18.4 through 18.6.2. Updated devices (iOS 18.7.3+ or iOS 26.3+) are protected.
The attack works through compromised legitimate websites — no phishing link required.
A likely Russian threat group is behind it, motivated by both espionage and financial theft.
Sophisticated exploits like this are no longer limited to governments — criminal groups can now buy them on the black market.
Updating your devices immediately is the single most important thing you can do to protect your business.
Your Digital Bodyguard Is Ready
At Chibitek, we act as your digital bodyguard — and threats like DarkSword are exactly why proactive security matters. Our Managed Intelligence approach means we're already monitoring for threats like this so you don't have to. With a 3.5-minute average response time and a Bronze Stevie Award for Best Technical Support, we're built to keep your business protected against even the most sophisticated attacks.
Don't wait until after an attack to take mobile security seriously. Contact us today to make sure every device in your organization is protected.
Adapted from 'Attackers Wielding DarkSword Threaten iOS Users' by Lookout Threat Intelligence.
Comments