Leaked DarkSword exploit kit puts hundreds of millions of iPhones at risk

Last week security researchers discovered that a newer version of DarkSword — an advanced iPhone exploit kit — was posted publicly on GitHub, enabling easy reuse by attackers. The leak exposes devices running older Apple operating systems, notably iOS 18 and earlier, and likely affects users who have not updated to Apple’s latest iOS 26. Apple issued an emergency update on March 11 for devices that cannot run the newest OS, but researchers warn the published files are simple HTML and JavaScript that can be repurposed quickly. The published code contains comments describing how to read and exfiltrate forensically relevant files from iPhones and iPads, raising immediate concern about large-scale data theft.

Key takeaways

• The DarkSword samples were uploaded to GitHub and include HTML/JavaScript components researchers say are trivial to host and reuse.
• Security teams at iVerify, Google, and Lookout identify the toolkit as effective against iPhones and iPads running iOS 18 or earlier.
• Apple reports roughly 2.5 billion active devices; about 25% remain on iOS 18 or older, implying hundreds of millions of vulnerable devices.
• Apple issued an emergency update on March 11 for devices unable to run later iOS versions; updated devices and Lockdown Mode are not reported to be affected.
• Researchers and hobbyist testers demonstrated working exploits in the wild, saying the payloads “work out of the box” and require little iOS expertise.
• Some code comments describe post-exploitation actions — copying contacts, messages, call history and keychain contents to remote servers.
• Attribution is limited: DarkSword has been linked previously to attacks on Ukrainian targets, but some claims remain unconfirmed.

Background

DarkSword first surfaced in security research weeks before the March 23, 2026 reporting on the public leak; analysts initially documented an active campaign exploiting older iOS releases. The toolkit is notable for its focus on iPhone and iPad internals and for including automated routines to extract sensitive files once a device is compromised. Historically, sophisticated exploit toolkits have originated in both private-sector and government-linked development, and — when leaked — quickly lower the bar for criminal reuse.

The leak follows a string of discoveries: researchers recently identified Coruna, another advanced iPhone hacking framework reportedly developed by a private defense contractor. Those revelations heightened scrutiny of how offensive tools circulate beyond their original operators. Platform hosting and disclosure practices matter here: when exploit code appears on a public repository, the usual containment window for defenders narrows drastically.

Main event

Researchers first noticed the GitHub upload last week; the samples include compact HTML and JavaScript files plus comments that explain exploitation and exfiltration steps. iVerify co-founder Matthias Frielingsdorf told reporters the files are “way too easy to repurpose,” noting the code’s simplicity means anyone can copy, host, and run the pages within minutes to hours. A security hobbyist using the handle matteyeux posted that they successfully compromised an iPad mini on iOS 18 with a circulating DarkSword sample.

Google security staff also reviewed the leak and agreed with assessments that the code reduces technical barriers for attackers. Microsoft, which operates GitHub, did not provide an immediate comment to reporters. Apple told researchers it was aware of the exploit activity and had issued an emergency patch on March 11 for devices that cannot upgrade to later iOS versions.

Inside the uploaded files, comments explicitly describe reading and transmitting “forensically-relevant files” from iOS devices via HTTP, and reference post-exploitation routines that collect contacts, messages, call logs and keychain data. One file oddly references uploading data to a Ukrainian apparel website; researchers have not determined whether that is a debugging artifact, misdirection, or operational detail.

Analysis & implications

The public release of DarkSword materially changes the threat landscape by democratizing a capability previously limited to well-resourced actors. When exploit code is simple HTML/JavaScript, the technical skill required to deploy phishing or watering-hole pages falls to basic web hosting and social-engineering efforts. That lowers the entry cost for criminals and increases the probability of widespread, opportunistic campaigns.

Scale amplifies the risk. With Apple’s reported base of about 2.5 billion active devices and roughly a quarter still on iOS 18 or earlier, the pool of vulnerable targets is measured in hundreds of millions. Even if only a fraction of those devices are accessible via discoverable web pages or targeted messaging, the absolute number of potential victims is large enough to support mass-harvest operations.

From a vendor and policy perspective, the incident underscores gaps in update adoption and the difficulty of remediating legacy devices. Apple’s March 11 emergency update mitigates risk for some older models, and Lockdown Mode is reported to block these specific exploits on updated devices, but many users delay or cannot install major OS upgrades. Platforms that host leaked code face pressure to triage dual obligations: prevent abuse while enabling legitimate security research and transparency.

Comparison & data

This table shows scale derived from Apple’s device base and the published share of older OS adoption. Even conservative conversion of the 25% figure produces a large vulnerable population; defenders must treat the exposure as a global, multi-month remediation challenge rather than an isolated outbreak.

Reactions & quotes

“This is bad. They are way too easy to repurpose,”

Matthias Frielingsdorf, co‑founder, iVerify

Frielingsdorf emphasized that the leaked files’ simplicity — primarily HTML and JavaScript — allows non-experts to deploy the payloads quickly, increasing the practical risk of criminal reuse.

“Keeping your software up to date is the single most important thing you can do,”

Sarah O’Rourke, Apple spokesperson

Apple’s comment accompanied its March 11 emergency update announcement and reiterated that devices running current software and Lockdown Mode are not believed to be at risk from the reported attacks.

“Our researchers agree the leaked samples lower the bar for attackers,”

Kimberly Samra, Google spokesperson

Google confirmed its analysis aligns with other security firms that examined the public samples and found functioning exploit code targeting iOS 18 devices.

Unconfirmed

• Attribution linking DarkSword to specific nation-state actors remains partial; earlier reporting tied versions to Russian-targeted operations but that linkage is not fully corroborated here.
• The reason a file references uploading data to a Ukrainian apparel site is unclear; it may be a test artifact, misdirection, or part of an operational chain but this has not been verified.
• The public repository’s completeness is uncertain — researchers have not confirmed whether the leak includes full operational servers, all supporting modules, or only sample components.

Bottom line

The public leak of DarkSword markedly raises risk for users on older iOS releases by making powerful exploit code trivially reusable. Organizations and individuals should prioritize installing Apple’s March 11 emergency update where applicable, upgrade to the latest supported iOS release, and enable Lockdown Mode when practical to reduce attack surface.

Security teams and platform operators must treat public code leaks as high-severity incidents: accelerate patching campaigns, monitor for exploitation patterns, and coordinate takedown requests where code is used in active attacks. Over the medium term, reducing the population of out-of-date devices and improving hosting platform triage will be essential to prevent similar leaks from spawning widespread abuse.

Sources

• TechCrunch — (media report summarizing leak and researcher findings)
• Apple Support — (official vendor security updates and guidance)
• GitHub — (code hosting platform)
• iVerify — (mobile security vendor analysis)
• Lookout — (security firm analysis)