Home
Mobiles
Mobiles News
DarkSword iOS Toolkit Now Public on GitHub, Lowering Barrier for Potential iPhone Exploit

DarkSword iOS Toolkit Now Public on GitHub, Lowering Barrier for Potential iPhone Exploit

DarkSword is designed to extract sensitive data from older, unpatched smartphones.

Written by Shaurya Tomer, Edited by David Delima | Updated: 24 March 2026 13:42 IST

DarkSword iOS Toolkit Now Public on GitHub, Lowering Barrier for Potential iPhone Exploit

Photo Credit: Pexels/ Karolina Grabowska

DarkSword used Safari, GPU, and kernel exploits to move from a website visit to full iPhone compromise

Click Here to Add Gadgets360 As A Trusted Source

Highlights

The spyware is designed to steal messages, passwords, and photos
DarkSword has been listed on GitHub, raising exploitation concerns
It uses zero-day vulnerabilities to completely compromise devices

Cybersecurity researchers recently warned of a growing threat that targeted older iPhone models. This threat, which was previously linked to targeted attacks, seems to have escalated after a more advanced version of the DarkSword hacking toolkit was leaked online. It is now available on public code-sharing platforms like GitHub, potentially making it significantly easier for threat actors to exploit vulnerabilities in older Apple devices.

DarkSword Code Published on GitHub

According to iVerify researchers, the updated version of DarkSword has been uploaded to GitHub, making it easier to access and deploy. The spyware is said to target several iPhone and iPad models running older versions of iOS, particularly iOS 18. It was still available on the platform at the time of publishing this story.

In a conversation with TechCrunch, Matthias Frielingsdorf, Co-Founder of iVerify, said that the updated versions of DarkSword share the same infrastructure as the original exploit. iVerify was one of the security firms that originally discovered the hacking campaign, alongside Lookout and Google Threat Intelligence Group (GTIG).

This Spyware Can Infect Your iPhone With a Single Website Visit

The code is said to consist of relatively basic HTML and JavaScript files, which can be hosted on a server within minutes. This potentially allows attackers to create malicious webpages designed to compromise vulnerable devices.

A security researcher also reportedly claimed to have successfully utilised the publicly available version of the exploit to compromise an iPad mini running iOS 18. This indicates that the attack can potentially be executed by threat actors without requiring advanced technical expertise.

Apple said it is aware of the exploit affecting devices running older and outdated operating systems. The company recently released an emergency update to address vulnerabilities on devices that cannot be upgraded to the latest iOS versions. As per the iPhone maker, devices with Lockdown Mode enabled are also protected from these specific attacks, even on out-of-date software.

Google, Microsoft and Others Join Hands to Fight Online Scams, Fraud

However, the tech giant reiterated that such devices should also be updated to the latest iOS version as soon as possible.

What is DarkSword Spyware?

The DarkSword spyware is an iOS full-chain exploit that leveraged multiple zero-day (undiscovered) vulnerabilities to completely compromise devices. Now available as a toolkit on code-sharing platforms, it links together several bugs to move from a web page to full control of the phone.

DarkSword is designed to extract sensitive data from compromised devices, as per security researchers. It can access contacts, messages, call history, and data stored in the iOS Keychain, including passwords and other credentials, and transmit this information to attacker-controlled servers.

This 'Digital Lutera' Android Malware Can Hijack Your UPI Account

Researchers note that comments within the leaked source code describe the operation of the exploit in detail, including specific instructions for exfiltrating data across the internet. In certain instances, the code is said to reference post-exploitation activities, outlining the processes for collecting and remotely transmitting data once a device has been compromised.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: iPhone hacking, iOS 18, Spyware, cybersecurity, Hacking

Shaurya Tomer

Email Shaurya Tomer

Shaurya Tomer is a Sub Editor at Gadgets 360 with 2 years of experience across a diverse spectrum of topics. With a particular focus on smartphones, gadgets and the ever-evolving landscape of artificial intelligence (AI), he often likes to explore the industry's intricacies and innovations – whether dissecting the latest smartphone release or exploring the ethical implications of AI advancements. In his free time, he often embarks on impromptu road trips to unwind, recharge, and ...More